# Zero-Day Exploitation of Joomla iCagenda and Balbooa Forms Extensions via Unauthenticated Arbitrary File Upload (CVE-2026-48939, CVE-2026-56291)

> Two Joomla extensions, iCagenda and Balbooa Forms, contain critical unauthenticated arbitrary file upload flaws (CVSS 10.0/9.8) enabling pre-auth remote code execution. Both were exploited as zero-days in the wild — iCagenda since June 15, 2026 via automated attacks, and Balbooa Forms during a live customer breach discovered July 8, 2026 — before CISA added both to the Known Exploited Vulnerabilities catalog on July 10, 2026 with an FCEB compliance deadline of July 13, 2026.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1254
- **ID:** TL-2026-1254
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48939, CVE-2026-56291, CVE-2026-56290

## Description

CVE-2026-48939 affects the iCagenda events-calendar extension for Joomla (versions 3.2.1–3.9.14 and 4.0.0–4.0.7). The frontend 'Submit an Event' registration form's file-attachment feature enforces the component's 'Registered Only' access restriction only at the presentation/view layer, not inside the actual controller that processes the upload. An unauthenticated attacker can POST directly to `index.php?option=com_icagenda&task=registration.submit` with a multipart `jform[attachment]` field containing a PHP file; the controller performs no extension allow-listing and never invokes Joomla's built-in `MediaHelper` security helper. The uploaded file lands, immediately web-executable, under `images/icagenda/frontend/attachments/`, giving the attacker unauthenticated PHP code execution as the webserver user. Automated in-the-wild exploitation was observed from June 15, 2026, with attacking clients self-identifying via the user-agent string `icagenda-batch/1.0`. The vendor patched in 3.9.15 and 4.0.8 (released June 15, 2026, the same day exploitation began).

CVE-2026-56291 affects Balbooa Forms, a Joomla form-builder extension, in all versions up to and including 2.4.0. Its frontend attachment-upload handler (`index.php?option=com_baforms&task=form.uploadAttachmentFile`) performs no authentication check, no CSRF token validation, and no server-side file-type validation. The model layer extracts the file extension directly from the attacker-supplied filename, sanitizes only the filename portion with `File::makeSafe()`, then reassembles the sanitized name with the untouched, attacker-controlled extension — allowing a `.php` file to be written verbatim into the web-accessible `images/baforms/uploads/form-<id>/` directory and subsequently executed by requesting it directly. The flaw was discovered on July 8, 2026 during a live customer incident (identified via abuse reports and access-log review), reported to Balbooa, and patched within 24 hours in version 2.4.1 (July 9, 2026), which adds server-side extension allow-listing, optional MIME-type verification, server-generated (non-user-supplied) filenames, and CSRF token enforcement.

Both vulnerabilities share an identical exploitation pattern common to the wider 2026 wave of Joomla third-party extension zero-days (also seen in SP Page Builder and Page Builder CK, CVE-2026-56290): a public-facing form intended for anonymous file submission (event attachments, form-field uploads) that skips file-type enforcement at the controller/model layer, writes into a predictable web-root upload directory, and thereby converts a benign upload feature into unauthenticated RCE. CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on July 10, 2026, triggering a Binding Operational Directive (BOD 22-01 / BOD 26-04) remediation deadline of July 13, 2026 for FCEB agencies. Post-compromise indicators reported by responders include unexpected `.php` files inside the respective upload directories and newly created, unrecognized Joomla administrator accounts — suggesting attackers used the initial webshell foothold to escalate to persistent admin-panel access.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1136 Create Account
- T1078 Valid Accounts
- T1036 Masquerading
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1087 Account Discovery
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1491 Defacement

## Sources

- [iCagenda and Balbooa Forms Joomla Flaws Exploited as Zero-Days](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html)
- [U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/195164/security/u-s-cisa-adds-icagenda-and-balbooa-forms-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CVE-2026-48939 – Unauthenticated File Upload RCE – iCagenda Extension for Joomla up to 4.0.7](https://www.ionix.io/threat-center/cve-2026-48939/)
- [CVE-2026-48939: Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension](https://github.com/shinthink/CVE-2026-48939)
- [CVE-2026-48939 - NVD/cvefeed vulnerability record](https://cvefeed.io/vuln/detail/CVE-2026-48939)
- [iCagenda Zero-Day File Upload RCE](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)
- [Balbooa Forms Unauthenticated File Upload Flaw (CVE-2026-56291)](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/)
- [CVE-2026-56291 - Vulnerability Details - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56291)
- [PageBuilder CK RCE - CVE-2026-56290 (related Joomla file-upload campaign)](https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/)
- [iCagenda 3.9.15 changelog](https://www.icagenda.com/docs/changelog/icagenda-3-9-15)
- [iCagenda 4.0.8 changelog](https://www.icagenda.com/docs/changelog/icagenda-4-0-8)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1254