Boletines de Vulnerabilidades |
CVE-2026-101126 |
|
| Software afectado | JOOMLA |
| Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath()) | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-101126 | |