# CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Unrestricted File Upload Flaws Under Active Exploitation

> Two unauthenticated unrestricted-file-upload vulnerabilities in the Joomla extensions iCagenda (CVE-2026-48939, CVSS 10.0) and Balbooa Forms (CVE-2026-56291, CVSS 10.0) are being actively exploited in the wild to write PHP web shells directly into web-accessible upload directories, giving attackers full remote code execution on the underlying server. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10, triggering a Binding Operational Directive remediation deadline of 2026-07-13 for Federal Civilian Executive Branch agencies.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1266
- **ID:** TL-2026-1266
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48939, CVE-2026-56291

## Description

iCagenda is a Joomla event-management extension whose public 'Submit an Event' registration form accepts file attachments. The vulnerable processing controller (reached via `index.php?option=com_icagenda&task=registration.submit`) enforced authorization only at the view layer, not in the controller itself, and performed no file-extension allow-listing, MIME-type check, or content validation before writing the uploaded file — with its attacker-supplied extension intact — into the web-accessible directory `images/icagenda/frontend/attachments/`. An unauthenticated attacker who first harvests a form token from any public event page can POST a `.php` file disguised as an attachment (`jform[attachment]=@shell.php;type=application/x-php`) and then request it directly to achieve remote code execution. Automated exploitation by a bot identifying itself as `icagenda-batch/1.0` began on 2026-06-15 at approximately 08:00 UTC, scanning Joomla sites for the extension, uploading a minimal PHP shell (`<?php echo "OK|".php_uname(); system($_GET["c"]); ?>`), and then immediately probing the attachments directory for the planted file. The vendor JoomliC was notified the same day and shipped fixes in versions 4.0.8 (current branch) and 3.9.15 (legacy branch); CVE-2026-48939 was formally published 2026-06-20. Affected releases span iCagenda 1.0.0 through 4.0.7 (RCE confirmed on Joomla 6 sites; the authorization bypass itself affects Joomla 2.5 through 6).

Balbooa Forms is a Joomla form-builder extension with an equivalent flaw: the frontend task `index.php?option=com_baforms&task=form.uploadAttachmentFile` accepted file uploads from any anonymous visitor with no authentication, no CSRF token, and no file-type allow-list, extracting and trusting the attacker-supplied file extension verbatim. This let an attacker upload a `.php` file into `images/baforms/uploads/form-<id>/` and execute it by direct request — full unauthenticated RCE (CWE-434). The flaw was discovered on 2026-07-08 not through routine research but via a Hetzner abuse report showing live exploitation against a customer site; it was privately disclosed to Balbooa the same day, and version 2.4.1 was released 2026-07-09 with CVE-2026-56291 assigned. All Balbooa Forms releases up to and including 2.4.0 are vulnerable; the vendor and the discovering researchers deliberately withheld the full request body and no public PoC has been released for this CVE (unlike iCagenda, for which a public PoC exploit exists on GitHub).

Both flaws follow an identical exploitation pattern common to Joomla extension supply chains: a public-facing, unauthenticated form-submission endpoint with a file-attachment feature that bypasses Joomla's core `MediaHelper` extension allow-list, letting attackers plant a web shell and pivot to full server compromise — command execution, data theft, rogue administrator account creation, content/template tampering, malware distribution, and reuse of the compromised server as attack infrastructure. CISA added both to the KEV catalog on 2026-07-10, and the Australian Cyber Security Centre has separately warned of a broader ongoing campaign abusing similar unauthenticated file-upload/RCE vectors across WordPress, Craft CMS, and Joomla plugins.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1136.001 Local Account
- T1036 Masquerading
- T1070.004 File Deletion
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1491.002 External Defacement

## Sources

- [Joomla sites running iCagenda or Balbooa exploited](https://cybersecuritynews.com/joomla-sites-running-icagenda-or-balbooa-exploited/)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html)
- [U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/195164/security/u-s-cisa-adds-icagenda-and-balbooa-forms-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [iCagenda Zero Day File Upload RCE Fixed in 4.0.8](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)
- [Balbooa Forms RCE - CVE-2026-56291](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/)
- [CVE-2026-48939 – Unauthenticated File Upload RCE – iCagenda Extension for Joomla up to 4.0.7](https://www.ionix.io/threat-center/cve-2026-48939/)
- [GitHub - shinthink/CVE-2026-48939: Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)](https://github.com/shinthink/CVE-2026-48939)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1266