CVE-2026-56291 describes an unauthenticated arbitrary file upload vulnerability in the Balbooa Forms extension for Joomla versions 1.0 up to 2.4.0. The flaw allows attackers to upload files with dangerous types, including executable files, which can lead to full remote code execution on the affected system. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a maximum CVSS 4.0 score of 10, indicating critical impact. No vendor advisory or patch information is currently available, and the extension is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to upload arbitrary executable files, which can lead to full remote code execution on the affected Joomla installation. This can compromise the confidentiality, integrity, and availability of the system. The vulnerability is critical and can be exploited remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Balbooa Forms extension or restricting file upload functionality to trusted users only. Monitoring for unusual file uploads and applying web application firewall rules to block malicious uploads may provide temporary risk reduction.