CVE-2026-56291 is a critical vulnerability in the Balbooa Forms extension for Joomla that permits unauthenticated arbitrary file uploads, including executable files. This flaw enables attackers to achieve full remote code execution on vulnerable installations. The issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability affects versions =1.0-2.4.0 of the extension. There is currently no vendor-provided patch or official remediation level. The CVSS 4.0 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary files on the server hosting the vulnerable Balbooa Forms extension. This leads to full remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The severity is critical with a CVSS score of 10, indicating a complete system compromise is possible without any authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Joomla extension and consider disabling or removing the Balbooa Forms extension if possible. Monitor for updates from the vendor and apply patches promptly once available.