Gridbox for Joomla CVE-2026-65886

The target must be a Joomla site with the Balbooa Gridbox extension installed at a version below 2.20.2, and the vulnerable photo-viewer feature must be reachable over the network (AV:N). Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special complexity are required - exploitation works against default installations that expose the photo viewer. Limiting factors: only the Gridbox extension (not core Joomla) is affected, so sites without Gridbox are not vulnerable; impact is confined to reading files the web-server process can access, and server hardening such as open_basedir or restrictive filesystem permissions narrows which files can be disclosed. Only confidentiality is affected - the flaw does not by itself modify data or execute code.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H, SC:H) scores 9.2 and reflects a genuinely low-barrier, high-confidentiality-impact issue: network reachable, low complexity, no privileges, no user interaction. Confidentiality impact is high while integrity and availability are unaffected - consistent with a read-only file-disclosure primitive rather than code execution. No EPSS score, no KEV listing, and no confirmed proof-of-concept were provided, so exploitation-probability signals are absent; the high CVSS is driven by ease-of-access and impact, not by evidence of in-the-wild activity. A third-party research blog (mysites.guru) references numerous critical Gridbox vulnerabilities, which raises the plausibility of exploit development but does not itself confirm weaponized code. Net: treat as a high-priority patch for any internet-facing Joomla site running Gridbox, while recognizing that active-exploitation evidence is currently missing rather than negative.

An unauthenticated attacker locates a Joomla site using Gridbox and sends a crafted HTTP request to the photo-viewer endpoint with a manipulated path parameter containing directory-traversal sequences pointing at configuration.php or /etc/passwd. The server returns the raw file contents, handing the attacker database credentials and Joomla secret keys that can be leveraged for full site takeover. No proof-of-concept has been confirmed, but the low complexity (AC:L) and lack of authentication (PR:N) make reliable exploitation straightforward once the parameter format is known.