Balbooa Forms 2.4.3.4 Security Hardening
As part of our ongoing commitment to product quality and user security, Balbooa Forms 2.4.3.4 is now available. This release addresses critical security vulnerabilities related to attachment metadata validation, file handling, and input sanitization, alongside key bug fixes and general stability improvements.
Because this update includes important security fixes, we strongly recommend that all customers update their installations to Balbooa Joomla Forms 2.4.3.4 as soon as possible.
Information
Detail
Description
Release Type
Security Hardening
Fixed Version
BA Forms 2.4.3.4
Release Date
29 September 2026
Reporters
Sergiy Tryzhychynskyi and Łukasz Rybak
Communication
Channel
Description
Status
Customer Email
Notification sent to all registered BA Forms customers with active email subscriptions.
Sent
Website
Security announcement published on the official website.
Published
Official Social Media
Announcement shared through official social media channels
Published
Security Fixes and Hardening
The latest release of Balbooa Forms strengthens ownership verification, data sanitization, path canonicalization, and safe shortcode rendering across form submission and processing mechanisms.
Component
Security Improvement
PHP Action & Shortcode Rendering
Enhanced escaping, quotation handling, and strict sanitization for field shortcodes embedded in administrator-defined post-submission PHP routines, preventing arbitrary code execution.
Attachment Access & Deletion Control
Implemented strict session ownership verification and server-side context checks for removeTmpAttachment, preventing unauthenticated cross-session deletion of temporary or stored attachments.
Attachment Metadata & Ownership
Implemented strict validation and session ownership checks for form attachments during final submission, preventing unauthenticated cross-session reference manipulation.
Path Sanitization (LFI Protection)
Added robust path canonicalization and boundary checks to getFilePath() and email attachment routines, preventing path traversal via crafted filenames in auto-reply notifications.
Input Sanitization & Output Escaping
Applied proper HTML escaping for original filenames and display names in administrator submission views, neutralizing Stored Cross-Site Scripting (XSS) vectors.
These improvements reinforce overall application resilience and ensure that all user-supplied data, metadata, and shortcode values are strictly validated before processing.
Action Required
To ensure your website benefits from these security improvements and bug fixes, please complete the following step:
Action
Description
Update Forms
Update all installations to BA Forms 2.4.3.4.
Acknowledgements
We would like to thank Sergiy Tryzhychynskyi and Łukasz Rybak for responsibly reporting these issues and helping us strengthen the security of Balbooa Forms.
We also thank David Jardin from the Joomla! Security Strike Team for coordinating the disclosure.
We truly appreciate the community's ongoing support and feedback in helping us make Balbooa extensions better with every release.