• 2 min read
Joomla extension bugs hit CISA’s exploited list
CISA added two Joomla extension flaws to its exploited-vulnerabilities catalog after attackers used them to upload malicious PHP files to sites.
Image: The Register
Attackers are actively exploiting two critical Joomla extension flaws that both carry a CVSS score of 10, prompting CISA to add them to its Known Exploited Vulnerabilities catalog this week.
The bugs affect iCagenda, an events calendar extension, and Balbooa Forms, a form builder used for contact requests, registrations, surveys, and file uploads. Joomla powers about 1.2 percent of all websites — roughly a million sites worldwide — and relies heavily on third-party extensions for much of its functionality.
Both flaws let attackers upload arbitrary files that can then be executed as PHP code on the server, effectively giving them remote control of a vulnerable site. CISA listed CVE-2026-48939 for iCagenda and CVE-2026-56291 for Balbooa Forms after confirming in-the-wild exploitation. Federal civilian agencies were ordered to patch under the agency’s vulnerability management directive, but the warning extends well beyond government users because both extensions are deployed on public-facing websites.
Recommended reading
AI deepfakes made fake employees a real corporate threat
The iCagenda issue stems from the extension’s attachment feature. According to CISA, attackers can upload a malicious PHP file through it, turning a normal file upload into remote code execution. Security firm mySites.guru said it saw attackers exploiting the bug just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. The attacks targeted the “Submit an Event” feature, which allows visitors to contribute entries to a site’s calendar. Researchers said they observed automated scanning for vulnerable installations before attackers dropped web shells onto compromised servers.
The Balbooa Forms flaw works in a similar way. Researchers said the extension’s frontend upload endpoint accepted files from anonymous visitors without authentication, CSRF protection, or meaningful file-type checks. That allowed attackers to upload a PHP file into a publicly accessible directory and execute it remotely.
Researchers said they found the Balbooa flaw while investigating an abuse report from a customer whose Joomla site was already under attack. Balbooa released version 2.4.1 on July 9, but researchers warned that exploitation is still continuing against sites that have not yet updated.
The key detail here is timing: fixes are available for both bugs, but attackers were already moving before many site operators had a chance to install them.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via The Register
