---
id: CVE-2026-101126
title: >-
  Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms <
  2.4.3.4 - The final form submission processes JSON arrays per upload field,
  checking only that IDs are numeric
summary: >-
  Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms <
  2.4.3.4 - The final form submission processes JSON arrays per upload field,
  checking only that IDs are numeric. Client-supplied filenames and display
  names are …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-22
  - CWE-73
vendor: balbooa
product: forms
affected:
  - forms < 2.4.3.4
patched:
  - forms 2.4.3.4
published: '2026-09-29'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T16:47:15.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101126'
references:
  - url: 'https://www.balbooa.com/'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
epss: 0.00245
epssPercentile: 0.15654
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-30T19:50:54.292346Z'
scores:
  nvd: 6.5
  cna: 6.9
ingestedAt: '2026-09-29T17:41:02.203Z'
---

## Overview

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())

## Affected

- `forms < 2.4.3.4`

## Remediation

Upgrade past the affected range:

- `forms 2.4.3.4`