{"id":"CVE-2026-101126","published":"2026-09-29T17:17:05.050","lastModified":"2026-09-29T21:39:02.570","description":"Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-22","CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://www.balbooa.com/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}