The Balbooa Forms extension for Joomla (versions 1.0.0 to 2.4.3.3) contains an unauthenticated XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the upload endpoint validates file extensions and MIME types but stores the attacker-controlled original multipart filename verbatim in the database. Later, when an administrator views the submission, the stored filename is concatenated directly into an HTML string assigned to innerHTML without sanitization, allowing execution of arbitrary JavaScript in the administrator's browser.

An attacker can craft a malicious filename that, when uploaded and later viewed by an administrator, executes arbitrary JavaScript code in the administrator's browser context. This can lead to session hijacking, privilege escalation, or other malicious actions within the Joomla administration interface. The vulnerability requires no authentication to upload the malicious file but requires an administrator to view the submission to trigger the exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid opening form submissions with uploaded files or implement manual sanitization of filenames before display. Monitoring vendor communications for an official fix is recommended.