Critical file-upload vulnerabilities in iCagenda and Balbooa Forms are being actively exploited to plant web shells on public-facing Joomla sites.
Summary
- CISA has added two Joomla extension vulnerabilities — CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) — to its Known Exploited Vulnerabilities catalog.
- Both flaws carry a maximum CVSS score of 10 and allow unauthenticated attackers to upload malicious PHP files, enabling remote code execution.
- Exploitation was observed in the wild before patches were released, with automated scanning used to identify vulnerable installations.
- Patches are available: iCagenda versions 4.0.8 and 3.9.15, and Balbooa Forms version 2.4.1.
- Exploitation of Balbooa Forms is reportedly continuing against unpatched sites.
Two Critical Flaws, One Shared Problem
CISA this week added a pair of Joomla extension vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming both are being actively abused in the wild. The affected extensions — iCagenda, an events calendar tool, and Balbooa Forms, a frontend form builder — each carry the maximum possible CVSS score of 10. Both flaws share the same fundamental weakness: they allow an unauthenticated attacker to upload a PHP file to the server and execute it remotely, effectively handing over control of the affected website.
How Each Vulnerability Works
The iCagenda flaw, tracked as CVE-2026-48939, is exploited through the extension’s ‘Submit an Event’ feature, which allows site visitors to contribute events to a calendar. Attackers can abuse the attachment functionality within that feature to upload a malicious PHP file, bypassing what should be a routine content-submission process and arriving at remote code execution instead.
The Balbooa Forms vulnerability, CVE-2026-56291, is arguably more straightforward. According to researchers, the extension’s frontend file upload endpoint accepted submissions from anonymous visitors with no authentication, no CSRF protection, and no meaningful restriction on file types. An attacker could upload a PHP web shell directly into a publicly accessible directory and execute it. The flaw came to light when researchers were investigating an abuse report from a customer whose Joomla site was already compromised.
Exploitation Preceded the Patches
The timeline here is instructive. Security firm mySites.guru observed attackers targeting the iCagenda vulnerability just hours before patched versions 4.0.8 and 3.9.15 were released in mid-June. That suggests attackers had prior knowledge of the flaw, or were conducting broad, automated scanning that happened to catch vulnerable sites in that narrow window. Researchers noted the use of automated tooling to scan specifically for vulnerable iCagenda installations before dropping web shells.
Balbooa responded with a patch — version 2.4.1 — on 9 July. However, researchers have warned that exploitation is continuing against sites that have not yet applied the update. The window between vulnerability disclosure and patch adoption remains a persistent and well-understood risk, particularly for third-party extensions on public-facing platforms.
Context: Joomla’s Extension Ecosystem
Joomla powers approximately 1.2 percent of all websites globally, which translates to roughly one million sites. The platform’s core is maintained centrally, but extensions like iCagenda and Balbooa Forms are developed by independent third parties. This creates a patchwork security landscape where each extension carries its own update cadence, disclosure practices, and risk profile. Organisations running Joomla sites often have a mix of extensions installed, not all of which will be subject to the same monitoring or patch management rigour as the core platform.
Federal Mandate, Broader Relevance
Under CISA’s binding operational directive, US federal civilian agencies are required to remediate the listed vulnerabilities within defined timeframes. That obligation does not extend to private organisations, but the listing serves as a clear signal that exploitation is real, not theoretical. Any organisation running Joomla with either of these extensions installed should treat this as an active threat, not a future consideration.
Why it matters
For security leaders overseeing web infrastructure, this incident reinforces a familiar but underweighted risk: third-party CMS extensions frequently operate outside the patch management and security testing processes applied to core platforms. Both vulnerabilities required no authentication and offered a direct path to remote code execution on a public-facing server — the kind of initial access that enables data theft, defacement, or use of the compromised host as a staging point for further attacks. With exploitation confirmed before patches were available for iCagenda, and continuing against unpatched Balbooa Forms installations, organisations need to act on verified inventory of their Joomla extension stack and close these gaps immediately.
What to do now
- Audit all Joomla installations in your environment and identify whether iCagenda or Balbooa Forms extensions are present.
- Update iCagenda to version 4.0.8 or 3.9.15 and Balbooa Forms to version 2.4.1 without delay.
- Inspect web server logs and publicly accessible upload directories on affected sites for signs of web shell deployment or unexpected PHP files.
- Review your process for tracking and patching third-party Joomla extensions, treating them with the same urgency as core platform updates.
- Consider temporarily disabling the affected extension features (event submission for iCagenda, frontend file uploads for Balbooa Forms) on sites where patching cannot be applied immediately.
