External risk intelligence

Balbooa Forms Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-65880

The vulnerability exists in a Joomla form-building extension that is designed to be embedded in public-facing web pages to collect user input. Since the form processing logic is publicly accessible to any site visitor, the attack surface is exposed by design for normal operation.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used Joomla extension for form building. Exploitation could allow unauthenticated remote code execution due to insecure processing of specific form fields. The main concern is confirming relevance and exposure.

Unauthenticated attackers can execute code remotely.
It affects a common tool for public-facing websites.
Assess if your organization uses this specific form extension.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary code on a vulnerable Joomla website by sending a specially crafted request to a form that includes a signature field. This attack leverages a flaw in how the form processing logic handles this field type, allowing unauthenticated users to bypass security measures and gain control of the server.

No authentication required for access.
Triggered by submitting a form with a signature field.
Risk of unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server by submitting specially crafted data to a form that includes the signature field. This could impact the integrity and availability of the affected Joomla website.

Server-side code execution.
Exploits insecure form processing logic.
Compromise website integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Balbooa Forms affects any Joomla site utilizing the affected extension, particularly those with the signature field type enabled. Responsibility for managing this risk likely falls to the website's application owners or the infrastructure team responsible for maintaining the Joomla installation. The immediate priority is to inventory all Joomla instances, confirm the presence and reachability of the vulnerable extension, and identify the specific site owners or administrators accountable for each instance to initiate a coordinated response.

Owners must identify all affected systems.
Verify signature field usage and external reachability.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Balbooa Forms Joomla extension?

Balbooa Forms is a component used within the Joomla content management system to build and embed interactive web forms. These forms are commonly used by site administrators to collect user data, feedback, or digital signatures directly on their websites.

How does CVE-2026-65880 allow remote code execution?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It occurs because the extension's processing logic fails to safely handle data submitted through specific form fields. An attacker can leverage this flaw to inject and run unauthorized commands on the underlying server that hosts the Joomla website.

Does every form trigger this vulnerability?

No. The flaw is specifically tied to the processing of the signature field type. If a form does not include a signature field, it is not susceptible to this specific attack path.

Is my website at risk if it uses this extension?

According to Halo Surface Signal, this vulnerability is very likely to be reachable. Because Balbooa Forms are designed to be embedded in public-facing web pages to collect input, the vulnerable processing logic is intentionally exposed to any internet visitor, making it highly accessible to potential attackers.

What steps should I take to address this issue?

First, inventory your Joomla installations to determine if the Balbooa Forms extension is present. If it is, verify whether any forms currently utilize the signature field type. Coordinate with your site administrators to restrict access to affected forms or update to a secure version of the extension provided by the vendor.

References

www.balbooa.com/joomla-forms

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.