The Balbooa Forms extension for Joomla (versions 1.0.0 to 2.4.3.3) contains an unauthenticated path traversal vulnerability (CWE-22) due to improper validation of user-supplied filenames in upload fields during public form submissions. The extension accepts JSON data from guests that specify file IDs and filenames, concatenates the filename below the configured upload directory without verifying the file's existence, ownership, or canonical path, and includes these files as attachments in auto-reply emails. An attacker can exploit this by submitting a numeric ID with a traversal filename such as '../../../../configuration.php' to receive arbitrary local files accessible to the Joomla process via email attachments.

An unauthenticated attacker can exfiltrate arbitrary local files from the server running the vulnerable Balbooa Forms extension by submitting crafted form data. This can lead to disclosure of sensitive configuration files or other data readable by the Joomla process, potentially compromising the confidentiality of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the auto-reply and attach uploaded files options in Balbooa Forms or restrict public form submissions that include upload fields. Monitor vendor communications for updates and apply patches promptly once released.