Between September 26 and 30, 2026, NVD published six critical CVEs across five Joomla extensions. The common thread is the same as in July: none of them requires authentication. An anonymous visitor is enough.
In July, the wave of upload-to-RCE flaws ended up in CISA's KEV catalog (see our article on the four July extensions). None of the six CVEs below is in KEV as of writing. Now is the time to deal with them, before they get there.
| CVE | Extension | CVSS | Class | Fixed version / NVD bound |
|---|---|---|---|---|
| CVE-2026-102425 | Balbooa Forms | 10.0 | RCE | fixed in 2.4.3.4 |
| CVE-2026-101127 | Balbooa Forms | 9.4 | stored XSS | fixed in 2.4.3.4 |
| CVE-2026-102427 | OrdaSoft Joomla CCK | 10.0 | upload → RCE | < 8.3.16 |
| CVE-2026-76570 | JCTables | 9.1 | SQL injection | 1.21.1 |
| CVE-2026-101110 | OrdaSoft Book Library | 9.8 | SQL injection | < 6.4.6 |
| CVE-2026-94130 | YouTube Gallery | 9.8 | SQL injection | < 5.7.3 |
Balbooa Forms — CVE-2026-102425 (10.0) and CVE-2026-101127 (9.4)
Balbooa Forms was already part of the July wave. This time there are two new flaws, both fixed in 2.4.3.4 according to the NVD descriptions.
CVE-2026-102425 (S:C, 10.0): the component lets administrators define PHP code that runs after a public form is submitted. Visitor-supplied values are inserted into it unprocessed before execution. Result: server-side code execution.
A public form must use the product's optional PHP-after-submission action
That's the exposure condition: only forms using this optional PHP action are affected. But few people can say offhand which forms on a site use it.
CVE-2026-101127 (9.4): the filename of a public upload is stored as-is, then rendered without escaping in the admin interface when an administrator opens the submission. It's a stored XSS aimed at the administrator's session.
To do: upgrade to 2.4.3.4 or later; until then, disable the PHP-after-submission action on public forms and don't open submissions with attachments from an admin account.
OrdaSoft Joomla CCK — CVE-2026-102427 (10.0)
An upload endpoint in the component is reachable through normal frontend routing, with no authentication or ACL check at all. The file's content is checked, but not its extension: the allow-list was in the code but not active. The file is written under the web root, in a location where PHP executes.
It's exactly July's class of flaw: unauthenticated upload leading to code execution.
Versions: NVD describes versions before 8.3.16 as vulnerable. Check OrdaSoft's advisory for the version to install.
To do: upgrade, then inspect the component's upload directories for .php files or executable extensions that have no business being there.
JCTables — CVE-2026-76570 (9.1)
The frontend CRUD API controller of JCTables (joomcode) checks neither the Joomla token nor authentication, and builds its SQL queries straight from request parameters — table names, column names and values. SQL injection in read and write queries.
Versions: NVD cites 1.21.1 as affected and publishes no fixed version. Check with the vendor; without a fix, disable the extension.
OrdaSoft Book Library — CVE-2026-101110 (9.8)
Unauthenticated SQL injection in the sorting parameters of the book list. The protection in place relied on a keyword denylist, which doesn't protect the part of the query where the value lands. I won't describe the bypass.
Versions: before 6.4.6 (free edition) according to NVD.
YouTube Gallery — CVE-2026-94130 (9.8)
Unauthenticated SQL injection in the video search and sorting of joomlaboat's extension. NVD specifies read queries — which is enough to extract the Joomla users table and its password hashes.
Versions: before 5.7.3 according to NVD.
Shared Detection
- Recent PHP files in
images/,media/,tmp/and the components' upload directories - Super User accounts created or modified recently in
#__usersand#__user_usergroup_map - Web server logs: bursts of anonymous requests to these components' entry points, SQL errors in PHP logs
- Form submissions with oddly named attachments (Balbooa Forms)
Mitigation
- Inventory installed extensions on every site, with versions. It's almost never done, and it's step one.
- Upgrade Balbooa Forms (2.4.3.4), Joomla CCK, Book Library and YouTube Gallery past the NVD bounds, following vendor advisories.
- Disable JCTables until the vendor confirms a fixed version.
- Block PHP execution in upload directories at the web server level: the defence that neutralises the whole class.
- Uninstall extensions you no longer use. A disabled extension is still a file on disk.
- If compromised: change admin passwords, regenerate the
secretinconfiguration.php, and verify core file integrity.
Why Continuous Monitoring of Joomla Extensions Matters
Joomla core is well tracked. Its extensions much less so, and that's where serial compromises come from. Six critical CVEs in five days across five different extensions can't be followed by hand.
With cveo.tech, inventory your sites and their extensions, and get alerted whenever a critical CVE affects one of them.