{"id":"CVE-2026-101127","title":"Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied ori…","summary":"Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied ori…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-79"],"vendor":"balbooa","product":"forms","affected":["forms < 2.4.3.4"],"patched":["forms 2.4.3.4"],"published":"2026-09-29","updated":"2026-10-06","sourceUpdated":"2026-10-06T16:47:37.000","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101127","references":[{"url":"https://www.balbooa.com/","label":"security@joomla.org"}],"tags":["nvd","cve.org"],"epss":0.0033,"epssPercentile":0.25962,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-30T19:50:17.214559Z"},"scores":{"nvd":9.4,"cna":8.6},"ingestedAt":"2026-09-29T17:41:02.203Z","slug":"CVE-2026-101127","body":"## Overview\n\nJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.\n\n## Affected\n\n- `forms < 2.4.3.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `forms 2.4.3.4`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":216547,"id":"CVE-2026-101127","ts":1791306613821,"field":"cvss","old":"8.6","new":"9.4"},{"seq":216546,"id":"CVE-2026-101127","ts":1791306613821,"field":"severity","old":"high","new":"critical"}]}