Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms Extensions via Unauthenticated Arbitrary File Upload (CVE-2026-48939, CVE-2026-56291)
Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms (TL-2026-1254) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-13. It has no confirmed attribution, affects iCagenda iCagenda Extension for Joomla, references 2 CVEs (CVE-2026-48939, CVE-2026-56291), maps to 17 MITRE ATT&CK techniques (T1005, T1036, T1059), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1254
- Threat ID
- TL-2026-1254
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, web hosting, education, small and medium business, nonprofit
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
Malware and tooling: CVE-2026-48939 public PoC exploit (GitHub: shinthink/CVE-2026-48939)
Two Joomla extensions, iCagenda and Balbooa Forms, contain critical unauthenticated arbitrary file upload flaws (CVSS 10.0/9.8) enabling pre-auth remote code execution. Both were exploited as zero-days in the wild — iCagenda since June 15, 2026 via automated attacks, and Balbooa Forms during a live customer breach discovered July 8, 2026 — before CISA added both to the Known Exploited Vulnerabilities catalog on July 10, 2026 with an FCEB compliance deadline of July 13, 2026.
How Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms works
CVE-2026-48939 affects the iCagenda events-calendar extension for Joomla (versions 3.2.1–3.9.14 and 4.0.0–4.0.7). The frontend 'Submit an Event' registration form's file-attachment feature enforces the component's 'Registered Only' access restriction only at the presentation/view layer, not inside the actual controller that processes the upload. An unauthenticated attacker can POST directly to `index.php?option=com_icagenda&task=registration.submit` with a multipart `jform[attachment]` field containing a PHP file; the controller performs no extension allow-listing and never invokes Joomla's built-in `MediaHelper` security helper. The uploaded file lands, immediately web-executable, under `images/icagenda/frontend/attachments/`, giving the attacker unauthenticated PHP code execution as the webserver user. Automated in-the-wild exploitation was observed from June 15, 2026, with attacking clients self-identifying via the user-agent string `icagenda-batch/1.0`. The vendor patched in 3.9.15 and 4.0.8 (released June 15, 2026, the same day exploitation began).
CVE-2026-56291 affects Balbooa Forms, a Joomla form-builder extension, in all versions up to and including 2.4.0. Its frontend attachment-upload handler (`index.php?option=com_baforms&task=form.uploadAttachmentFile`) performs no authentication check, no CSRF token validation, and no server-side file-type validation. The model layer extracts the file extension directly from the attacker-supplied filename, sanitizes only the filename portion with `File::makeSafe()`, then reassembles the sanitized name with the untouched, attacker-controlled extension — allowing a `.php` file to be written verbatim into the web-accessible `images/baforms/uploads/form-<id>/` directory and subsequently executed by requesting it directly. The flaw was discovered on July 8, 2026 during a live customer incident (identified via abuse reports and access-log review), reported to Balbooa, and patched within 24 hours in version 2.4.1 (July 9, 2026), which adds server-side extension allow-listing, optional MIME-type verification, server-generated (non-user-supplied) filenames, and CSRF token enforcement.
Both vulnerabilities share an identical exploitation pattern common to the wider 2026 wave of Joomla third-party extension zero-days (also seen in SP Page Builder and Page Builder CK, CVE-2026-56290): a public-facing form intended for anonymous file submission (event attachments, form-field uploads) that skips file-type enforcement at the controller/model layer, writes into a predictable web-root upload directory, and thereby converts a benign upload feature into unauthenticated RCE. CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on July 10, 2026, triggering a Binding Operational Directive (BOD 22-01 / BOD 26-04) remediation deadline of July 13, 2026 for FCEB agencies. Post-compromise indicators reported by responders include unexpected `.php` files inside the respective upload directories and newly created, unrecognized Joomla administrator accounts — suggesting attackers used the initial webshell foothold to escalate to persistent admin-panel access.
MITRE ATT&CK techniques used in TL-2026-1254
Collection
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Privilege Escalation
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery
Persistence
T1136 Create Account; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
Impact
Resource Development
Reconnaissance
Affected products and versions in Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
- iCagenda — iCagenda Extension for Joomla
Vulnerable versions: 1.0.0-4.0.7; 3.2.1-3.9.14; 4.0.0-4.0.7
Fixed in: 3.9.15; 4.0.8 - Balbooa — Balbooa Forms Extension for Joomla
Vulnerable versions: 1.0-2.4.0
Fixed in: 2.4.1
Remediation for Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
Patches
- iCagenda 3.9.15 (legacy branch)
- iCagenda 4.0.8
- Balbooa Forms 2.4.1
Immediate actions
- Update iCagenda to 3.9.15 (legacy 3.x) or 4.0.8+ immediately
- Update Balbooa Forms to 2.4.1 or later immediately
- Scan images/icagenda/frontend/attachments/ for unexpected .php files
- Scan images/baforms/uploads/ (all form-<id>/ subfolders) for unexpected .php files
- Audit Joomla administrator user list for unrecognized or recently created accounts
- Review webserver access logs for the user-agent string icagenda-batch/1.0
- Review access logs for POST requests to index.php?option=com_icagenda&task=registration.submit and index.php?option=com_baforms&task=form.uploadAttachmentFile from unauthenticated sessions
- If immediate patching is not feasible, disable the iCagenda file-attachment feature and the Balbooa Forms frontend attachment upload, or block unauthenticated access to both endpoints at the WAF/reverse-proxy layer
Workarounds
- Disable the iCagenda event-submission attachment feature
- Disable or restrict the Balbooa Forms frontend attachment upload
- Block unauthenticated POST requests to the vulnerable controller endpoints at the WAF/reverse-proxy level
- Deny PHP execution within images/icagenda/ and images/baforms/ via webserver configuration as a compensating control
Longer-term hardening
- Disable PHP execution in all Joomla images/ and media upload directories via webserver configuration (e.g., .htaccess/nginx location block denying .php execution)
- Adopt Joomla's built-in MediaHelper allow-list validation for any custom or third-party upload-handling code
- Implement a Joomla extension inventory and patch-cadence process for third-party components, which are a recurring source of unauthenticated RCE
- Deploy file-integrity monitoring on web-root upload directories
- Enforce CSRF tokens and authentication checks on all frontend form-processing controllers as a baseline extension security review requirement
CVEs associated with Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
Weaknesses (CWE) in Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
CWE-434, CWE-284
Timeline of Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
- iCagenda ships fixed versions 3.9.15 and 4.0.8 the same day exploitation is first observed.
- Automated in-the-wild exploitation of CVE-2026-48939 begins against unpatched iCagenda installations, with scanning traffic identified by the user-agent string icagenda-batch/1.0.
- CVE-2026-48939 is published/assigned for the iCagenda arbitrary file upload vulnerability.
- Active exploitation of CVE-2026-56291 in Balbooa Forms is discovered during a live customer incident, identified via abuse report and access-log review; privately disclosed to the vendor.
- Balbooa ships fixed version 2.4.1 within 24 hours of disclosure, adding extension allow-listing, MIME validation, server-generated filenames, and CSRF enforcement; CVE-2026-56291 is assigned.
- CISA adds both CVE-2026-48939 and CVE-2026-56291 to the Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of active exploitation.
- SecurityAffairs and other outlets report on the CISA KEV additions and remediation requirements under BOD 22-01/BOD 26-04.
- The Hacker News publishes a consolidated report on both zero-day exploitations and the CISA KEV listing.
- Binding Operational Directive remediation deadline for FCEB agencies to patch both vulnerabilities.
Sources cited for Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
- iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days
- U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CVE-2026-48939 – Unauthenticated File Upload RCE – iCagenda Extension for Joomla up to 4.0.7
- CVE-2026-48939: Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension
- CVE-2026-48939 - NVD/cvefeed vulnerability record
- iCagenda Zero-Day File Upload RCE
- Balbooa Forms Unauthenticated File Upload Flaw (CVE-2026-56291)
- CVE-2026-56291 - Vulnerability Details - NVD
- PageBuilder CK RCE - CVE-2026-56290 (related Joomla file-upload campaign)
- iCagenda 3.9.15 changelog
- iCagenda 4.0.8 changelog
Threats related to Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms
- CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Arbitrary File Upload
- CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Unrestricted File Upload Flaws Under Active Exploitation
- CVE-2026-48939 & CVE-2026-56291: Perfect-10 Joomla Extension Bugs (iCagenda, Balbooa Forms) Actively Exploited, Added to CISA KEV
- Australia (ACSC) Warns of Global Campaign Exploiting Vulnerable CMS Platforms to Deploy Webshells
- CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload)
Detection coverage for TL-2026-1254
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1254 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.