Threat database

A path traversal vulnerability (CWE-22) exists in the balbooa.com Gridbox extension for Joomla versions 1.0.0 through 2.20.3.1. The issue occurs in the image preview functionality where the containment logic only checks for prefix matching, allowing access to files in sibling directories outside the intended images root. The vulnerability is limited to certain image file types and is rated medium severity with a CVSS score of 6.3.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the balbooa.com Gridbox extension for Joomla versions 1.0.0 through 2.20.3.1. The vulnerability arises because the addLanguage action does not require a POST request and thus bypasses the Joomla session token validation that is only enforced on POST methods. This allows a GET request to trigger the action without verifying the token, potentially enabling unauthorized actions if the victim has the required permissions.

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.

CVE-2026-102425 is a critical remote code execution vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The vulnerability arises from improper control of code generation (CWE-94) due to the way administrator-defined PHP code executes after public form submissions. Specifically, the extension replaces form-field shortcodes with user-submitted values inside a double-quoted PHP string before calling eval(), enabling attackers to inject and execute arbitrary PHP code. Exploitation requires the use of the optional PHP-after-submission feature with an attacker-controlled shortcode. The vulnerability has a CVSS 4.0 score of 9.5, indicating critical severity. No official patch or vendor advisory is provided in the data, and no known exploits in the wild have been reported.

CVE-2026-101126 is a medium severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The flaw involves improper limitation of pathname to a restricted directory, allowing potential path traversal and metadata tampering. The vulnerability arises because the extension processes JSON arrays per upload field, trusting client-supplied filenames and display names without sufficient validation. This can lead to cross-session claiming and unauthorized file metadata manipulation.

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.

CVE-2026-67363 is a high-severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.1. It allows unauthenticated attackers to tamper with payment amounts by exploiting the stripeCharges and payAuthorize endpoints, which accept client-controlled charge totals without verification. This flaw enables attackers to purchase items at arbitrary prices, including very low amounts, and to forge line items, quantities, and shipping details. The endpoints lack authentication and CSRF protections, increasing the risk of exploitation.

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.