Threats Tagged 'ghsa-5w98-66mc-mjqc'

CVE-2026-101126 is a medium severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The flaw involves improper limitation of pathname to a restricted directory, allowing potential path traversal and metadata tampering. The vulnerability arises because the extension processes JSON arrays per upload field, trusting client-supplied filenames and display names without sufficient validation. This can lead to cross-session claiming and unauthorized file metadata manipulation.