CVE-2026-102424 is a High (CVSS 7.5) unauthenticated path traversal in Balbooa Forms for Joomla before 2.4.3.4. A guest can make the component attach local server files to an auto-reply email. Update to 2.4.3.4 or later, or turn off attaching uploaded files.
What's affected
The weakness is CWE-22 (path traversal). The record says Balbooa Forms versions before 2.4.3.4 are affected, so 2.4.3.4 or later is the fixed range. The record's only reference is the vendor's home page, and we did not find a vendor advisory with more detail, so the description in the record is our source.
According to the record, the component accepts the state of upload fields as JSON controlled by the guest during public form submission. For any object whose ID only looks numeric, it trusts the supplied filename, joins it to the configured upload directory and adds the result to a list of local attachment paths. It does not load the referenced attachment record, check ownership, session, form or field, require that the ID exists, normalise the path or enforce that it stays inside the upload directory.
The exposure depends on two form options. If a form has its normal auto reply enabled and the option to attach uploaded files, the component sends those local paths as email attachments to the address given in an email field of the form. A guest can then receive any file that the Joomla process can read. Sites without that combination of options are outside the described scenario.
The vector is network, low complexity, no privileges, no user interaction, with high impact on confidentiality only.
How to check if you're exposed
In the Joomla administrator, open Components, then Balbooa Forms, and read the version. You can also see it under System, Manage, Extensions. If it is below 2.4.3.4, you are in range.
Then check each form for the two options in the record: auto reply and the option to attach uploaded files. Forms with both are the ones to fix first. Forms with neither are not in the scenario the record describes.
Review mail logs for auto replies carrying attachments that do not look like files a visitor uploaded, such as configuration or backup files. If you find any, treat the site's secrets as exposed. Joomla configuration files hold database credentials and other secrets.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Update Balbooa Forms to 2.4.3.4 or later.
- Turn off the option to attach uploaded files to auto replies on every form until you have updated.
- Review outbound mail logs for unexpected attachments.
- If a sensitive file may have been sent, rotate the secrets in it, starting with database credentials, and review access logs.
- Run Joomla under an account that can read only what it needs, and keep backups outside the web root.
Why it matters
Path traversal lets input steer a file read outside the intended folder. Here, the unusual part is the delivery: the file leaves the server as an email attachment, to an address the attacker chose. That means no direct response from the site is needed to collect the data.
Files like a CMS configuration file are a common target because they hold credentials. The record does not mark the CVE as known exploited, and we found no report of exploitation. The attack needs no account, which makes the update more urgent for public sites.
Quick check
Which forms are exposed?
Per the record, forms with auto reply enabled and the option to attach uploaded files enabled.
What is the fixed version?
The record says versions before 2.4.3.4 are affected, so 2.4.3.4 or later. Confirm on the vendor site.
Sources
Last reviewed: 18 October 2026.
