--- title: Two Joomla Extensions Hit by Zero-Day File Upload... description: CISA added two Joomla extension vulnerabilities — CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) — to its Known Exploited Vulnerabilities catalog... canonical: https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed | daily.dev og:description: CISA added two Joomla extension vulnerabilities — CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) — to its Known Exploited Vulnerabilities catalog... og:url: https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4 og:image: https://api.daily.dev/og/posts/BXyEPSdq4.png og:image:alt: Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed **[Latest Hacking News](https://daily.dev/sources/lhn)** · 4 min read · 0 upvotes · 0 comments ## Summary CISA added two Joomla extension vulnerabilities — CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) — to its Known Exploited Vulnerabilities catalog after automated attackers exploited unrestricted file upload flaws before patches were available. Both bugs score a perfect 10.0 on CVSS 4.0 and allow unauthenticated attackers to plant executable PHP files in the web root, achieving remote code execution. Mass exploitation of iCagenda began hours before the vendor shipped a fix. Balbooa Forms had three compounding failures: no authentication check, no CSRF verification, and no file type validation. Admins should patch immediately, inspect upload directories for unexpected PHP files, and treat any evidence of compromise as a full incident requiring credential rotation and audit of recently modified files. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA orders feds to patch max severity Joomla plugin flaw by Friday](https://daily.dev/posts/cisa-orders-feds-to-patch-max-severity-joomla-plugin-flaw-by-friday-dxh7nbq8a) · BleepingComputer · 0 upvotes · 0 comments - [CVE-2026-48907: How the Joomla JCE Exploit Works and What to Do About It](https://daily.dev/posts/cve-2026-48907-how-the-joomla-jce-exploit-works-and-what-to-do-about-it-nnouuvxo2) · Latest Hacking News · 0 upvotes · 0 comments - [Hackers exploit critical flaw in Ninja Forms WordPress plugin](https://daily.dev/posts/hackers-exploit-critical-flaw-in-ninja-forms-wordpress-plugin-vf9rfivjr) · BleepingComputer · 5 upvotes · 0 comments --- Tags: [#cms](https://daily.dev/tags/cms), [#security](https://daily.dev/tags/security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed","url":"https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4"},"datePublished":"2026-07-15T07:29:39.122Z","dateModified":"2026-10-14T02:28:17.793Z","description":"CISA added two Joomla extension vulnerabilities — CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms) — to its Known Exploited Vulnerabilities catalog...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e36894a345bdbbb00ac099ab46cecbeb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e36894a345bdbbb00ac099ab46cecbeb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/two-joomla-extensions-hit-by-zero-day-file-upload-attacks-before-patches-landed-bxyepsdq4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cms,security,zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"Two Joomla Extensions Hit by Zero-Day File Upload Attacks Before Patches Landed"}]} ```