CISA flags two exploited Joomla extension flaws that let attackers upload web shells

CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, both in popular Joomla extensions and both allowing attackers to upload dangerous files. The iCagenda event calendar flaw (CVE-2026-48939, rated 10.0) lets an attacker upload arbitrary files through its attachment feature, ending in PHP code execution, while the Balbooa Forms flaw (CVE-2026-56291) allows unauthenticated upload of executable files leading to full remote code execution. Federal agencies were ordered to fix them by July 13. The additions line up with a broader campaign, recently flagged by Australia's cyber agency, in which attackers scan the internet and exploit known content-management-system and plugin flaws to plant web shells on vulnerable sites.

Check

Identify Joomla sites using the iCagenda or Balbooa Forms extensions, update them to fixed versions, and inspect web directories for unexpected PHP files or web shells indicating a successful upload.

Affected

Websites running the iCagenda or Balbooa Forms Joomla extensions (CVE-2026-48939, CVE-2026-56291); attackers are actively uploading malicious files to gain remote code execution and plant web shells on affected servers.

Fix

Update the affected extensions to patched versions, remove unused plugins, make web directories read-only where possible, monitor for unauthorized file creation, and block unexpected child processes spawning from web servers.