{"id":"CVE-2026-102425","title":"Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission","summary":"Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports fo…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-94"],"vendor":"balbooa","product":"forms","affected":["forms < 2.4.3.4"],"patched":["forms 2.4.3.4"],"published":"2026-09-29","updated":"2026-10-06","sourceUpdated":"2026-10-06T16:48:10.717","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102425","references":[{"url":"https://www.balbooa.com/","label":"security@joomla.org"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00586,"epssPercentile":0.47833,"exploits":{"github":2,"githubRepos":["https://github.com/murrez/CVE-2026-102425","https://github.com/tonydelouvre/CVE-2026-102425"],"checkedAt":"2026-10-27T16:53:21.941Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-30T19:51:16.490361Z"},"scores":{"nvd":10,"cna":9.5},"ingestedAt":"2026-09-29T17:41:02.204Z","slug":"CVE-2026-102425","body":"## Overview\n\nJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.\n\n## Affected\n\n- `forms < 2.4.3.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `forms 2.4.3.4`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":216549,"id":"CVE-2026-102425","ts":1791306614544,"field":"cvss","old":"9.5","new":"10"},{"seq":213998,"id":"CVE-2026-102425","ts":1790803598800,"field":"exploit_available","old":"false","new":"true"}]}