Which versions of Gridbox for Joomla are affected by CVE-2026-65889?

The Gridbox extension for Joomla (versions before 2.20.2) contains a critical vulnerability allowing unauthenticated remote attackers to delete arbitrary directory trees on affected servers,…

How to fix or mitigate CVE-2026-65889?

Within 24 hours, audit all Joomla installations for Gridbox versions and immediately disable or uninstall the extension on systems running versions 2.20.2 or earlier; implement network-level restrictions limiting administrative access to the Joomla environment. Within 7 days, deploy WAF rules to block requests to the generateNewApp method, enable real-time filesystem monitoring and access logging for deletion events, and conduct a test of backup restoration to verify recovery capability. Within 30 days, upgrade to Gridbox 2.20.2 or later once released, perform a complete filesystem audit to confirm no unauthorized deletions occurred, and review all installed Joomla extensions for similar access control weaknesses.

Gridbox for Joomla CVE-2026-65889

Q: What is the CVSS score of CVE-2026-65889?

CVE-2026-65889 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50334 CRITICAL

Improper Access Control (CWE-284)

2026-07-29 Joomla

GHSA-p2r5-9v5x-pf34

Authentication Bypass Gridbox Extension For Joomla

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable method with low complexity (AV:N/AC:L/PR:N/UI:N); impact is destructive data loss scored as availability (A:H) with no confidentiality or integrity per the vendor framing.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 14:24 vuln.today

CVE Published

Jul 29, 2026 - 13:54 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

AnalysisAI

Arbitrary recursive directory deletion in the Gridbox extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers destroy directory trees on the server through the exposed generateNewApp method, which fails to enforce access control (authentication bypass). Rated CVSS 4.0 9.2 (Critical) with a high availability impact on both the vulnerable component and subsequent systems, this is a data-destruction / denial-of-service flaw rather than a code-execution or data-theft one. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Gridbox is a commercial drag-and-drop page-builder extension for the Joomla CMS, developed by balbooa.com. The vulnerable code path is the generateNewApp method, which is reachable without authentication and performs directory removal operations without validating the caller's identity or constraining the target path. The root cause is classified as CWE-284 (Improper Access Control): a privileged, state-changing filesystem operation is exposed to unauthenticated actors. Because Joomla extensions run within the CMS's web root under the web server's privileges, a recursive delete driven by attacker input can remove application files, uploaded media, and potentially adjacent directories, mapping directly to the vendor's high availability rating for both the component and subsequent systems.

RemediationAI

Vendor-released patch: upgrade Gridbox to version 2.20.2 or later, which is the first fixed release per the '< 2.20.2' affected range. Obtain the update from the vendor at https://www.balbooa.com/gridbox and apply it through Joomla's extension update mechanism. If immediate patching is not possible, restrict network access to the Joomla administrator and extension endpoints (for example via web-server IP allowlisting or a WAF rule blocking requests that invoke the generateNewApp task/method), accepting that this may interfere with legitimate remote administration; alternatively, disable or uninstall the Gridbox extension until it is updated, with the trade-off that any pages built with Gridbox will stop rendering. Ensure current, tested off-server backups exist so that any directory deletion can be recovered, since the primary impact is destructive data loss.