EXPOSURES › CVE-2026-101127
CVE-2026-101127
CRITICALBalbooa Forms extension allows unauthenticated stored XSS via malicious filenames in uploaded attachments.
An attacker can upload a file with a malicious filename, which gets stored verbatim in the database. When an administrator views the submission, the filename is concatenated directly into innerHTML, executing arbitrary JavaScript. This exposes admin accounts to session hijacking and data theft, requiring immediate patching and input sanitization.
Shame score — A critical XSS vulnerability in a widely-used Joomla extension that allows unauthenticated exploitation via simple filename manipulation, indicating a lack of basic input sanitization and secure coding practices.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.