CISA flags active RCE exploitation in Joomla extensions; separate SQLi fix lands for Quix Page Builder

Attackers are actively exploiting two Joomla extensions to take over websites via arbitrary file uploads, according to a recent alert highlighted by BleepingComputer. At the same time, a separate disclosure from mySites.guru describes an unauthenticated SQL injection in a popular Joomla page builder that has been patched. Together, these updates underscore how widely used CMS add‑ons can quickly become high‑impact entry points when flaws surface.

Why it matters

Remote code execution (RCE) via file upload typically means an attacker can place and run malicious server‑side code, leading to data theft or complete site takeover. SQL injection (SQLi) can expose sensitive data stored in a site’s database. Because calendar, forms, and page‑builder extensions are common on production sites, timely patching is critical when issues are confirmed.

What’s known right now

BleepingComputer reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Joomla extension flaws to its Known Exploited Vulnerabilities (KEV) catalog, warning of in‑the‑wild exploitation and directing U.S. federal agencies to act quickly. The issues involve arbitrary file uploads that lead to RCE:

• CVE-2026-48939 in iCagenda (event and calendar extension). CISA’s KEV entry warns of unrestricted file uploads enabling PHP code execution.
• CVE-2026-56291 in Balbooa Forms (drag‑and‑drop form builder). CISA notes file upload handling can permit dangerous file types and result in RCE.

Per the BleepingComputer report, fixes are available:

• iCagenda: versions 4.0.8 and 3.9.15
• Balbooa Forms: version 2.4.1

CISA’s KEV catalog is here: http://www.cisa.gov/known-exploited-vulnerabilities-catalog

Separately, mySites.guru disclosed an unauthenticated SQL injection in the Quix Page Builder for Joomla and states the issue is fixed in Quix 6.2.1. The disclosure characterizes the bug as error‑based SQLi that could allow an unauthenticated visitor to read data from the site database. The post also notes that a CVE has been requested; the identifier status was not confirmed in the disclosure. Details: https://mysites.guru/blog/quix-sql-injection-disclosure/

Practical steps

Based on the reporting and disclosures above, administrators should:

• Identify whether iCagenda or Balbooa Forms is installed and update to the patched versions listed by BleepingComputer: iCagenda 4.0.8/3.9.15 and Balbooa Forms 2.4.1.
• If running Quix Page Builder, apply the vendor’s fix in version 6.2.1 per the mySites.guru disclosure.
• Monitor CISA’s KEV catalog and the extensions’ official channels for any follow‑up guidance.

Caveats and what remains unclear

This article relies on the BleepingComputer report of CISA’s KEV additions and the mySites.guru Quix disclosure. Toolslib did not independently verify exploitation activity. For Quix, the disclosure indicates a CVE was requested; a final identifier and severity from a CNA or NVD were not confirmed in the source post. If additional technical details or timelines emerge from CISA, the extension vendors, or public advisories, readers should treat those as authoritative updates.

Bottom line

CISA’s KEV additions signal confirmed exploitation of file‑upload RCE flaws in two Joomla extensions, and a separate SQLi fix for a widely used page builder highlights the broader extension attack surface. If these components are present in your environment, prioritize the vendor updates referenced above and keep an eye on official advisories for any new guidance.

References:

• BleepingComputer coverage: https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-rce-flaws-in-joomla-extensions/
• CISA KEV catalog: http://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Quix Page Builder SQLi disclosure (mySites.guru): https://mysites.guru/blog/quix-sql-injection-disclosure/

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.