Post cover image

September 12, 2026

CVE-2026–61424 & CVE-2026–56291 |Joomla! Arbitrary File Upload

DJ-Classifieds is a Joomla extension created by DJ-Extensions. It transforms a Joomla site into an advertising or classifieds platform…

By azr

2 min read

DJ-Classifieds is a Joomla extension created by DJ-Extensions. It transforms a Joomla site into an advertising or classifieds platform, allowing users to publish items and create different types of listings.

( https://dj-extensions.com/blog/dj-classifieds/the-most-popular-advertising-categories-for-classified-ads-portal)

CVE-2026–61424 is a vulnerability in DJ-Classifieds for Joomla.

CWE-434 — Unrestricted Upload of File with Dangerous Type.

In DJ-Classifieds, a user would create an ad and upload an image for it; however, due to weak validation, the "image" could actually be any file even a PHP script. Consequently, a user without privileges could upload files to the server and access them publicly.

HTTP Request → imageupload → upload() → insufficient validation → attacker-controlled file uploaded → file stored → potential code execution depending on server configuration.

The flow of this failure outside of theory is:

Unauthenticated Attacker
        │
        ▼
Sends an HTTP upload request
        │
        ▼
DJ-Classifieds `imageupload`
        │
        ▼
`upload()` processes the submitted file
        │
        ▼
Insufficient file validation
        │
        ▼
Attacker-controlled file is accepted
        │
        ▼
File is stored on the server
        │
        ▼
      ┌─────────────────────┐
      │                     │
      ▼                     ▼
File remains inert     Server interprets
                           the file
                              │
                              ▼

                   file in /tmp/djupload/shell.php

                              │
                              ▼

                  Potential Remote Code Execution

Affected Versions:

Component: DJ-Classifieds (Joomla extension)

Impacted Range: Versions 1.0 through 3.11.1

Fix Version: 3.11.2

exploration:

None

mitigation measures:

Configure the ".htaccess" file to block access to that directory

update that component to version 3.11.2 or higher.

CVE-2026–56291

Balbooa Joomla Forms is an Advanced Joomla Form Builder. Create Joomla Contact Forms, Feedback Forms, Online Surveys or any other types of forms. Balbooa Joomla Forms is a Drag and Drop Forms Builder that allows you to quickly and easily build modern and beautiful Joomla forms without touching a line of code. (https://extensions.joomla.org/extension/forms)

This CVE is another arbitrary file upload vulnerability, but in Balbooa-Forms.

The structure of Balbooa Forms is:

Joomla │ └── Balbooa Forms │ ├── Form Builder ├── Form Fields ├── Form Submissions ├── File Uploads ├── Integrations

The form builder is a tool that web application administrators use to create forms; it allows you to drop in the file, so you don't have to type out all the HTML code for the form.

Example:

Form Builder │ ├── Name ├── Email ├── Message └── File Upload

but the failure itself occurs in this flow:

Unauthenticated Attacker │ ▼ Sends an HTTP file upload request │ ▼ Balbooa Joomla Forms │ ▼ File Upload functionality │ ▼ Upload handler processes the submitted file │ ▼ Insufficient file validation │ ▼ Attacker-controlled file is accepted │ ▼ File is stored on the server │ ▼ /images/baforms/uploads/form-*/shell.php │ ▼ File becomes accessible through the web server │ ▼ Server interprets the uploaded PHP file │ ▼ Potential Remote Code Execution

(https://app.opencve.io/cve/CVE-2026-56291)

Affected Versions:

Component: Balbooa Forms (Joomla extension)

Impacted Range: All versions prior to 2.4.1

Fix Version: 2.4.1

exploration:

None

Mitigation: Update to version 2.4.1 or higher.

Sources

CVE-2026–61424 — DJ-Classifieds

CVE-2026–56291 — Balbooa Forms