CISA flags two Joomla extension flaws with perfect 10 severity

Key Takeaways

• Two Joomla extensions, iCagenda and Balbooa Forms, have critical CVSS 10.0 vulnerabilities under active exploitation
• Attackers can upload and execute arbitrary PHP code, gaining full remote control of affected servers
• Patches are available: iCagenda 4.0.8/3.9.15 and Balbooa Forms 2.4.1

CISA added two Joomla extension vulnerabilities to its Known Exploited Vulnerabilities catalog this week after confirming attackers are actively using both flaws to upload malicious PHP code onto websites. The bugs, both carrying the maximum CVSS score of 10.0, affect iCagenda (an events calendar) and Balbooa Forms (a form builder). Patches exist. If you run either extension, update today.

What are the vulnerabilities?

CVE-2026-48939 targets iCagenda's "Submit an Event" feature, which lets site visitors contribute events to a calendar. The attachment upload mechanism failed to validate file types properly. Attackers exploited this to upload PHP files that execute on the server, handing them remote code execution.

CVE-2026-56291 hits Balbooa Forms through its frontend upload endpoint. The extension accepted files from anonymous visitors without authentication, CSRF protection, or meaningful file type checks. Uploading a PHP file to a publicly accessible directory and calling its URL was enough to execute arbitrary code.

Both flaws let attackers drop web shells, a persistent backdoor that survives reboots and gives full control over the compromised server.

How quickly did attackers move?

Security firm mySites.guru observed attacks on iCagenda just hours before the patched versions shipped in mid-June. Automated scanners hunted for vulnerable installations, then dropped web shells before site owners even knew a fix was coming.

The Balbooa Forms flaw surfaced during an abuse investigation for a customer whose site was already compromised. Balbooa released version 2.4.1 on July 9, but researchers warn exploitation continues against unpatched sites.

Why this matters for SaaS operators

Joomla powers roughly 1.2 million websites, about 1.2 percent of the web. Many SaaS companies still run marketing sites, customer portals, or documentation hubs on Joomla. Third-party extensions handle the features the core CMS doesn't provide, from forms to calendars to e-commerce. That means your attack surface expands with every plugin you install.

Extensions are developed by independent vendors, not Joomla's core team. Security quality varies. A single unpatched extension can become the entry point attackers need to pivot into backend systems, steal customer data, or deface your site.

What should you do right now?

• Check if you run iCagenda or Balbooa Forms. Update to iCagenda 4.0.8 (or 3.9.15 for the older branch) and Balbooa Forms 2.4.1 immediately.
• Audit your upload directories for unexpected PHP files. Look for files created recently that you didn't upload.
• Review all installed Joomla extensions. Remove any you no longer use. Fewer extensions mean fewer attack vectors.
• Subscribe to CISA's KEV catalog feed. When federal agencies are ordered to patch, the vulnerability is confirmed exploited, not theoretical.

Federal civilian agencies must patch under CISA's Binding Operational Directive, but the warning applies to everyone. If you run a public-facing Joomla site with these extensions, you're a target today.

The broader CMS security question

This incident echoes a recurring pattern. The core CMS ships secure enough, but the extension ecosystem becomes the weak link. WordPress sees this constantly. Joomla's smaller market share doesn't protect it; attackers follow opportunity, not popularity rankings.

For SaaS founders weighing CMS options, the lesson isn't "avoid Joomla." It's "audit your dependencies." Managed platforms like Webflow or Shopify reduce this surface area by limiting what you can install. Self-hosted options on Cloudways or Kinsta give more control but require you to monitor every extension you add.

Frequently Asked Questions

What is the CVSS score for these Joomla vulnerabilities?

Both vulnerabilities received a CVSS score of 10.0, the maximum possible, indicating critical severity with remote code execution capability.

Which Joomla extensions are affected?

iCagenda (events calendar) and Balbooa Forms (form builder) are the two affected extensions. Both have patches available.

How do I know if my Joomla site is compromised?

Check upload directories for unexpected PHP files with recent creation dates. Look for files you didn't upload, especially in publicly accessible folders used by these extensions.

What is CISA's KEV catalog?

The Known Exploited Vulnerabilities catalog is a list maintained by CISA of vulnerabilities confirmed to be actively exploited in the wild. Federal agencies must patch KEV entries under binding directive.

Are the patches already available?

Yes. Update to iCagenda 4.0.8 or 3.9.15, and Balbooa Forms 2.4.1 to close these vulnerabilities.

Source: www.theregister.com