Which versions of Balbooa Gridbox are affected by CVE-2026-65885?

Balbooa Gridbox (Joomla extension versions before 2.20.2) contains a critical arbitrary file upload vulnerability enabling remote code execution on affected servers.

How to fix or mitigate CVE-2026-65885?

Within 24 hours: disable Balbooa Gridbox extension on all Joomla instances running versions before 2.20.2 via the Extension Manager, and restrict Joomla administrator panel access to authorized IP addresses or VPN only. Within 7 days: audit upload directories (/images and file storage paths) for suspicious executable files or web shells added since the vulnerability was disclosed, search user tables and access logs for unauthorized accounts or upload attempts consistent with CVE-2026-65884 exploitation, and verify no unauthorized code execution has occurred in web server logs. Within 30 days: deploy Gridbox version 2.20.2 or later once released by the vendor, implement Web Application Firewall rules blocking file uploads to protected directories, and disable PHP script execution in upload directories via .htaccess (php_flag engine off) or equivalent web server configuration.

Balbooa Gridbox CVE-2026-65885

Q: What is the CVSS score of CVE-2026-65885?

CVE-2026-65885 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.3%.

EUVD-2026-50298 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-29 Joomla

GHSA-ch97-6m5m-2jh8

File Upload Gridbox Extension For Joomla Balbooa Com

9.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

9.1 CRITICAL

Network file-upload to RCE with low complexity and no interaction; PR:H because the standalone flaw needs an authenticated upload-capable account, S:C as web-shell execution escapes the app to the OS.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 13:01 vuln.today

CVE Published

Jul 29, 2026 - 12:05 cve.org

CRITICAL 9.4

DescriptionCVE.org

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

AnalysisAI

Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenticated user upload files of arbitrary type via the extension's file-upload methods, bypassing type restrictions (CWE-434). Uploading executable server-side code (e.g. a PHP web shell) yields authenticated remote code execution, and the vendor rates it CVSS 4.0 9.4 with an 'Attacked' exploit-maturity flag and 'Red' urgency. The impact is materially worse because it chains with CVE-2026-65884, which lets the attacker create the account required to reach the upload feature - collapsing the privilege barrier and effectively enabling attacker-driven RCE. No public exploit is identified at time of analysis, though the CVSS threat metric (E:A) signals the vendor considers exploitation activity present.

Technical ContextAI

Gridbox is a commercial drag-and-drop page-builder / layout extension for the Joomla CMS, published by balbooa.com; the affected CPE is cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla:*. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the extension's file-upload handlers accept and store files without adequately validating extension, MIME type, or content, allowing server-executable scripts to land in a web-reachable directory. Because Joomla runs on PHP, an uploaded .php (or equivalently interpreted) file placed under the web root can be requested directly and executed by the web server, turning a storage flaw into code execution. The chained CVE-2026-65884 addresses the account/privilege side, meaning the 'authenticated' precondition is not a durable control against a determined attacker.

RemediationAI

Vendor-released patch: upgrade Gridbox to version 2.20.2 or later, which is the fixed release for versions '< 2.20.2'; obtain it from the vendor at https://www.balbooa.com/gridbox. Because this vulnerability is dangerous largely in combination with the account-creation flaw CVE-2026-65884, also apply that fix (same upgrade line) and, as an immediate compensating control, disable or lock down self-registration in Joomla so unauthenticated users cannot provision accounts that reach Gridbox upload features. Additional workarounds where patching must wait: restrict access to the Joomla administrator/back-end and Gridbox editor endpoints by IP allowlist or VPN (trade-off: legitimate remote editors lose direct access), and configure the web server to refuse execution of scripts in Gridbox/Joomla upload/media directories (e.g. deny PHP handler mapping under the upload path - trade-off: may break features that legitimately serve dynamic content from those paths, so test first). Audit existing upload directories for unexpected script files before and after upgrading, since a pre-patch compromise would persist across the update.