# CVE-2026-101127: Balbooa Forms unauthenticated upload filename stored XSS

Source: https://junglewise.ai/threats/cve-2026-101127-joomla-extension-balbooa-com-unauthenticated-upload-filename  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-101127 · Severity: info · Published 2026-09-29

Balbooa Forms is a Joomla extension for creating online forms and collecting submissions. An attacker can upload a file to a public form with a malicious filename containing JavaScript code. When a site administrator views the submission, the injected code executes in their browser, potentially compromising their session or account and allowing the attacker to modify site content or access sensitive data.</exec_brief>
<parameter name="technical_details">The vulnerability is a stored cross-site scripting (XSS) flaw in the form upload handler. The public form endpoint accepts file uploads, validates file extensions and MIME types, but stores the user-supplied original filename from the multipart request in the database without sanitization. When an administrator retrieves the submission, client-side JavaScript concatenates the stored filename directly into HTML via innerHTML, allowing XSS execution. No authentication is required to upload the malicious file.</technical_details>
<parameter name="severity">high

Technologies: [Balbooa.Com Forms](https://junglewise.ai/threats/technologies/balbooa-com-forms). Vendors: [Balbooa.Com](https://junglewise.ai/threats/vendors/balbooa-com).

## Quick answers

**Is CVE-2026-101127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101127 being exploited in the wild.

**How severe is CVE-2026-101127?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Balbooa.Com Forms before 2.4.3.4.

**Is there a fix for CVE-2026-101127?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101127 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-101127?** Check whether you run Balbooa.Com Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- balbooa.com Forms before 2.4.3.4

## Timeline

- 2026-09-29: disclosed

## References

- [https://www.balbooa.com/](https://www.balbooa.com/)

## Related threats

- [Balbooa Forms file metadata tampering](https://junglewise.ai/threats/cve-2026-101126-joomla-extension-balbooa-com-file-meta-data-tampering-in-balbooa)
- [Balbooa Forms unauthorized attachment deletion](https://junglewise.ai/threats/cve-2026-101112-joomla-extension-balbooa-com-unauthorized-deletion-of)