CVE-2026-102424 in Forms Extension
Summary
by MITRE • 09/29/2026
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Balbooa Forms versions prior to 2.4.3.4 represents a critical unauthenticated path traversal flaw that allows remote attackers to exfiltrate sensitive local files from the target Joomla installation. This security defect stems from improper input validation and lack of access control mechanisms within the component's handling of file upload states during public form submissions. Specifically, when a user interacts with an email field in a publicly accessible form, the system processes the associated upload-field state as JSON data controlled by the client side. The application logic iterates through objects within this JSON payload where the identifier appears numeric and blindly trusts the filename provided by the attacker without performing any server-side verification or sanitization checks.
Technically, the flaw manifests when the component concatenates the supplied filename directly below the configured upload directory to construct a local file path for attachment purposes. The system fails to canonicalize this path, meaning it does not resolve symbolic links or normalize relative references such as dot-dot-slash sequences. Furthermore, there is no check to verify that the referenced ID actually exists in the database, nor is there any validation of ownership, session validity, or form field context. This absence of authorization checks allows a guest user, who requires no authentication credentials, to manipulate the file path structure arbitrarily. By injecting traversal characters into the filename parameter, an attacker can break out of the intended upload directory and access files located elsewhere in the web root or system directories that are readable by the Joomla process account.
The operational impact of this vulnerability is severe, as it enables unauthorized disclosure of confidential information stored on the server. An attacker can exploit this flaw to retrieve sensitive configuration files such as configuration.php, which typically contains database credentials, FTP login details, and encryption keys. Additionally, other critical system files or user-uploaded documents that reside outside the designated upload folder but remain accessible via the web server's file permissions can be downloaded by an external party. This capability effectively compromises the confidentiality of the entire Joomla environment, potentially leading to further attacks such as remote code execution if database credentials are obtained and exploited against backend services.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended directory. It also relates to CWE-915: Improper Control of Dynamically-Identified Variables, as the application fails to validate or sanitize variables derived from user input before using them in system commands or file operations. In terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1083: File and Directory Discovery, where adversaries use discovered files for further exploitation, and potentially T1567: Exfiltration Over Web Service if the exfiltrated data is sent out via email as part of the auto-reply mechanism.
To mitigate this vulnerability, administrators must upgrade Balbooa Forms to version 2.4.3.4 or later, where these input validation and path traversal protections have been implemented. In cases where immediate patching is not feasible, temporary mitigations include restricting file upload permissions on the server to prevent access to sensitive directories like configuration.php through web requests. Additionally, implementing strict allowlists for allowed characters in filenames and enforcing canonicalization of all file paths before processing can reduce the risk. Ensuring that the Joomla process runs with minimal privileges further limits the scope of files an attacker could potentially read even if they manage to bypass other controls. Regular security audits and code reviews focusing on input validation practices are recommended to prevent similar issues in custom extensions or future updates.