Which versions of Gridbox for Joomla are affected by CVE-2026-65886?

The Balbooa Gridbox page-builder extension for Joomla (CVE-2026-65886, CVSS 9.2) allows unauthenticated remote attackers to read arbitrary server files, including credentials and configuration data.

How to fix or mitigate CVE-2026-65886?

Within 24 hours, inventory all Joomla systems running Balbooa Gridbox versions prior to 2.20.2 and immediately disable or remove the extension if feasible, or restrict external network access to the photo viewer component via firewall rules. Within 7 days, deploy a web application firewall rule to block directory traversal patterns (../, ..\, and URL-encoded variants) targeting the Gridbox component, and enable detailed logging of access attempts to this module for security monitoring. Within 30 days, subscribe to vendor security advisories and prepare a patching plan; once CVE-2026-65886 patches are released, prioritize immediate deployment across all affected Joomla installations.

Gridbox for Joomla CVE-2026-65886

Q: What is the CVSS score of CVE-2026-65886?

CVE-2026-65886 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50354 CRITICAL

Path Traversal (CWE-22)

2026-07-29 Joomla

GHSA-jc3g-m4mj-mm5m

Path Traversal Gridbox Extension For Joomla Balbooa Com

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable unauthenticated path traversal (AV:N/AC:L/PR:N/UI:N) reads files beyond the app's security scope (S:C) with high confidentiality but no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 15:15 vuln.today

CVE Published

Jul 29, 2026 - 13:58 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

AnalysisAI

Arbitrary file read in the Balbooa Gridbox page-builder extension for Joomla (all versions before 2.20.2) lets remote unauthenticated attackers read files outside the intended web root through the extension's photo viewer component. The flaw is a classic path traversal (CWE-22) reachable over the network with no authentication or user interaction, enabling disclosure of configuration files, credentials, and other sensitive server content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Gridbox is a drag-and-drop page-builder / layout extension for the Joomla CMS published by balbooa.com (CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla). The vulnerable code path is the extension's photo viewer, which accepts a file/path parameter and uses it to serve image content without adequately canonicalizing or constraining the value to an approved directory. This is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22): by injecting traversal sequences (e.g. ../../) or absolute paths, an attacker steers the file-read operation to arbitrary locations on the host filesystem, subject to the privileges of the PHP/web-server process. Because Joomla extensions typically run within the same process as the CMS, disclosed files can include Joomla's configuration.php (database credentials, secret keys) and OS files.

RemediationAI

Vendor-released patch: upgrade Gridbox to version 2.20.2 or later, which addresses the photo-viewer path traversal; obtain the update from https://www.balbooa.com/gridbox. If immediate patching is not possible, apply compensating controls: restrict access to the Gridbox photo-viewer endpoint at the web server or WAF layer by adding path-traversal signature rules that block ../ , encoded traversal sequences, and absolute-path parameters (trade-off: WAF rules can be bypassed and may break legitimate image requests); place the site behind authentication or IP allow-listing for non-public deployments; and ensure the PHP process runs with least privilege and open_basedir restrictions so file reads are confined to the Joomla directory (trade-off: open_basedir may break plugins that legitimately read outside the web root). Rotate Joomla secrets and database credentials if you suspect configuration.php was exposed. Review the third-party writeup at https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ for related issues.