CVE-2026-101127 is a critical (CVSS 9.4) stored cross-site scripting flaw in Balbooa Forms, a Joomla extension, in versions before 2.4.3.4. A visitor can plant script through an upload filename, and it runs when an administrator opens the submission. Update to 2.4.3.4 or later and review submissions.
What's affected
The record covers Balbooa Forms before version 2.4.3.4. Update to that release or later. The record points only to the vendor home page, so confirm the release there.
The form upload endpoint is public. It checks the file extension and detected type but stores the visitor's original filename as is. Later, the admin screen builds an HTML string with that name and assigns it with innerHTML.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for Balbooa Forms.
- Read the installed version. The record covers Balbooa Forms before 2.4.3.4.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Update the extension to 2.4.3.4 or later. Download it from the vendor, since the record points only to the vendor's home page.
- If you cannot update today, disable or uninstall the extension and remove its public pages from the menu.
- Review recent form submissions with attachments for odd filenames before an administrator opens them. Do not open suspicious ones in a logged-in admin session.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
This is stored XSS, filed as CWE-79. The input is a filename, which most developers do not think of as untrusted. It is stored, then later written into the page through innerHTML, which treats the string as markup.
The damage depends on who opens it. The target is an administrator, so script running in that session could act with admin rights. That is why the vector scores confidentiality and integrity as high. Escape output at the point of use and prefer textContent to innerHTML for plain text.
The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Who is at risk when the flaw fires?
Mostly the site administrator who opens the submission in the Joomla admin area. That is why reviewing submissions before opening them, and updating, both matter.
Sources
Last reviewed: 19 October 2026.
