# CVE-2026-48939 & CVE-2026-56291: Perfect-10 Joomla Extension Bugs (iCagenda, Balbooa Forms) Actively Exploited, Added to CISA KEV

> Two maximum-severity (CVSS 10.0) unauthenticated arbitrary file-upload vulnerabilities in the Joomla iCagenda calendar extension (CVE-2026-48939) and Balbooa Forms extension (CVE-2026-56291) are being actively exploited in the wild to plant PHP web shells and achieve remote code execution on compromised Joomla sites. Both were exploited as zero-days before patches shipped and were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10, amid a broader Five-Eyes-flagged, possibly AI-accelerated global campaign against CMS plugins.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1300
- **ID:** TL-2026-1300
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48939, CVE-2026-56291, CVE-2026-48907

## Description

iCagenda (CVE-2026-48939) is a Joomla events-calendar extension whose frontend "Submit an Event" form exposes an attachment upload feature. The access-control check for the upload was implemented only in the view layer and never enforced in the controller (com_icagenda, task=registration.submit), meaning an attacker did not need a real account or even a linked submission form — a CSRF/form token harvested from any public iCagenda page (e.g., the public events list) was sufficient to POST directly to the processing endpoint via the jform[attachment] parameter. The component preserved the attacker-supplied file extension and wrote the file verbatim into images/icagenda/frontend/attachments/, a web-root path with PHP execution enabled, yielding pre-authentication remote code execution. Automated exploitation using a scanner identifying itself via the User-Agent 'icagenda-batch/1.0' began around 2026-06-15 08:00 UTC, harvesting tokens, uploading a PHP web shell, and immediately fetching it to confirm execution — all fully automated. Vulnerable releases span 1.0.0 through 4.0.7 (mySites.guru additionally cites 3.2.1-3.9.14 and 4.0.0-4.0.7 as the actively targeted ranges); JoomliC shipped fixes in 3.9.15 and 4.0.8 on 2026-06-15/16.

Balbooa Forms (CVE-2026-56291) suffers a near-identical class of bug in its frontend attachment-upload handler (com_baforms, task=form.uploadAttachmentFile). The controller performed no authentication check and no Session::checkToken() CSRF validation, and derived the stored file's extension directly from the attacker-supplied filename with no allow-list or MIME validation, writing it with an attacker-controlled name into images/baforms/uploads/form-<id>/ inside the web root. Any anonymous visitor could therefore upload and immediately execute a file such as shell.php. mySites.guru discovered the flaw on 2026-07-08 while investigating a customer abuse report and confirmed active in-the-wild exploitation via access logs; Balbooa shipped a four-layer fix (extension allow-list, MIME validation, server-generated filenames, CSRF tokens) in version 2.4.1 on 2026-07-09. Affected versions run 1.0 through 2.4.0.

Both vulnerabilities share CWE-434 (Unrestricted Upload of File with Dangerous Type), CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and result in complete pre-auth RCE on the underlying web server user. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-10 with a three-day remediation deadline (2026-07-13) under Binding Operational Directive 26-04, ordering federal civilian agencies to patch or discontinue use. The exploitation of these two extensions is occurring against the backdrop of a much larger campaign: on 2026-07-09 the Australian Cyber Security Centre (ACSC) issued an alert on a large-scale global exploitation campaign against CMS platforms and plugins — including WordPress (WPBookit, Gravity Forms, Ninja Forms, Breeze Cache, WavePlayer), Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE — abusing unauthenticated file upload, RCE, SSRF, and deserialization bugs to deploy web shells at scale, disproportionately impacting small and medium businesses. A Five Eyes joint statement referenced in reporting on the campaign flagged that advances in AI are accelerating the speed and scale of such opportunistic mass-exploitation operations and shrinking the window between vulnerability disclosure and active exploitation.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1136.001 Local Account
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1102 Web Service
- T1071.001 Web Protocols
- T1491.002 External Defacement
- T1587.001 Malware
- T1588.002 Tool
- T1105 Ingress Tool Transfer
- T1083 File and Directory Discovery
- T1593.002 Search Engines

## Sources

- [Baddies caught exploiting extensions bugs with 'perfect 10' scores on vulnerable Joomla websites](https://www.theregister.com/security/2026/07/14/baddies-caught-exploiting-extensions-bugs-with-perfect-10-scores-on-vulnerable-joomla-websites/5271001)
- [iCagenda Zero Day File Upload RCE Fixed in 4.0.8](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)
- [Balbooa Forms Unauthenticated File Upload Flaw](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/)
- [iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html)
- [Organizations Warned of Exploited Joomla Extension Vulnerabilities](https://www.securityweek.com/organizations-warned-of-exploited-joomla-extension-vulnerabilities/)
- [CVE-2026-48939 NVD Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)
- [CVE-2026-56291 NVD Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56291)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-48939](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-56291](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291)
- [shinthink/CVE-2026-48939 PoC exploit](https://github.com/shinthink/CVE-2026-48939)
- [GHSA-4rh3-rmh3-hv6h — iCagenda arbitrary file upload advisory](https://github.com/advisories/GHSA-4rh3-rmh3-hv6h)
- [Australia warns of global campaign targeting vulnerable CMS platforms](https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/)
- [CISA BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [ACSC Alert: Global Campaign Targeting Vulnerable CMS Platforms and Plugins](https://www.cyber.gov.au/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1300