CISA Flags Critical Unrestricted File Upload Flaws in Joomla Extensions iCagenda (CVE‑2026‑48939) and Balbooa Forms (CVE‑2026‑56291)
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Joomla extensions to its Known Exploited Vulnerabilities (KEV) catalog: iCagenda (CVE‑2026‑48939) and Balbooa Forms (CVE‑2026‑56291). Both flaws allow unauthenticated attackers to upload arbitrary files with dangerous types, leading to PHP code execution and full remote code execution (RCE) on vulnerable sites.
Why It Matters for Compliance & Audit Readiness
- Unrestricted file‑upload vulnerabilities directly contravene SOC 2 CC6.1 (Change Management) and CC6.2 (System Operations) which require controls over code deployment and execution.
- Continuous‑compliance programs must map these newly‑identified gaps to existing controls, collect remediation evidence, and demonstrate timely remediation to auditors.
- Verisq’s Control Mapping capability automates the linkage between CVE remediation tickets and SOC 2 control evidence, providing a defensible audit trail.
Who Is Affected — Organizations that run Joomla‑based websites, including media outlets, educational institutions, NGOs, and any SaaS providers that embed iCagenda or Balbooa Forms in customer portals.
Recommended Actions
- Apply vendor‑released patches or upgrade to the latest versions of iCagenda and Balbooa Forms immediately.
- Verify that file‑upload sanitization controls are enforced (e.g., MIME type validation, file‑type whitelisting).
- Update your SOC 2 control matrix to reflect the new risk, capture remediation tickets as evidence, and schedule a post‑remediation audit review.
Source: Security Affairs
Technical Notes
- iCagenda (CVE‑2026‑48939) – CVSS 10.0; unrestricted file upload via the attachment feature enables arbitrary PHP code execution.
- Balbooa Forms (CVE‑2026‑56291) – Unauthenticated arbitrary file upload leading to full RCE.
- Both flaws are classified as “unrestricted upload of file with dangerous type” and are actively exploited in the wild.
Source: CISA KEV catalog, vendor advisories