Description
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
balbooa.com Balbooa Forms extension for Joomla
Default version status: unaffected
1.0.0-2.4.3.3affected