Balbooa-Forms

Joomla Balbooa Forms Unauthenticated Arbitrary File Upload → RCE (CVE-2026-56291)

Balbooa Forms is a popular drag-and-drop form builder extension for Joomla!. Its form.uploadAttachmentFile task — reachable via the unauthenticated combaforms component entry point — accepts multipart file uploads for form attachments but performs neither a…