External risk intelligence

Balbooa Joomla Extension Unauthenticated Directory Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65889

This vulnerability affects a Joomla extension, which is typically deployed as a public-facing web application. Since the extension functions within a web-accessible content management system, it is commonly reachable via the internet as part of the site's standard web surface.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a Joomla extension that could allow unauthorized actors to recursively delete directories. While the specific impact and affected data are not detailed, the technology's common use in public-facing websites means it could be exposed. The primary concern at this stage is to confirm if our organization uses this extension and is therefore exposed.

Unauthenticated directory deletion vulnerability exists.
Affects a common type of web extension.
Confirm usage and exposure of this extension.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending a request to a Joomla site that uses the affected extension. No authentication is required, and the attacker can trigger the vulnerability by invoking a specific method that allows them to recursively delete directories. This could lead to significant data loss or disruption of the targeted website.

No authentication required for access.
Invoking a specific function triggers deletion.
Risk of data loss and disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in a Joomla extension could allow an unauthenticated actor to recursively delete directories, potentially impacting the integrity and availability of the website and its hosted data. This could occur through the `generateNewApp` method when the extension is running.

Website files and data could be deleted.
Unauthenticated actors could trigger directory deletion.
Site unavailability and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Joomla extension's unauthenticated directory deletion vulnerability likely impacts teams responsible for web application security and content management systems. The first practical step is to identify all instances of the affected Joomla extension, determine their exposure and business criticality, and then locate the accountable owner for remediation planning.

Application owners should lead the remediation.
Verify asset inventory and external reachability.
Plan coordinated vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Balbooa Joomla extension?

This is a software component designed for the Joomla content management system, often used to build complex website layouts, manage forms, or create galleries. It integrates directly into the Joomla framework to extend its native functionality. Because it operates within the CMS, it shares the same environment and permissions as the website itself, making it a critical part of the site's structural and operational stack.

What does CVE-2026-65889 mean for my site?

This vulnerability is classified as an improper access control issue (CWE-284) and a path traversal flaw (CWE-22). In plain English, it means the software fails to verify who is asking for a file operation, allowing unauthorized users to trigger code that recursively deletes folders. This specifically impacts the availability of your website by enabling destructive actions that can wipe out directory structures essential for the site's operation.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to the website that targets the 'generateNewApp' method. Because this method lacks authentication checks, no login or special privileges are needed to execute the command. Notably, simply viewing the site or interacting with standard pages does not trigger the bug; the attacker must intentionally send a request that invokes this specific internal function.

Do I need to worry about this if my site is internal?

According to Halo Surface Signal, this vulnerability is most relevant to internet-facing sites, as the Joomla extension is typically deployed to be web-accessible. While internal sites are not immune, the risk is significantly higher for public-facing assets. If your instance is truly isolated from the internet, the attack surface is reduced, but you should still assess the extension's presence since internal applications are often reachable by lateral movement within a network.

What is the first step to address this?

Your priority is to determine if your organization is running any version of the Balbooa extension earlier than 2.20.2. Consult your asset inventory or CMS administrator to locate all active installations. Once identified, evaluate the criticality of those specific sites and prepare to update the extension to the patched version provided by the vendor, ensuring that application owners are informed to coordinate the maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.