Gridbox CVE-2026-66489

The Gridbox extension for Joomla by balbooa.com must be installed and active on the target Joomla site, running any version from 1.0.0 through 2.20.1. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms no authentication, no special configuration, no user interaction, and no elevated complexity is required - exploitation is viable against any default installation of the affected version range that is publicly internet-accessible. What limits real-world exploitation is the niche commercial footprint of this specific extension; it is not a Joomla core component, so exposure is bounded to sites that have explicitly purchased and installed Gridbox. No platform, OS, or hosting-environment restriction is specified in the available data.

The CVSS 5.3 Medium score is internally consistent: AV:N/AC:L/PR:N/UI:N indicates trivial unauthenticated remote exploitation with no prerequisite conditions, but S:U/C:L/I:N/A:N confines realistic impact to partial information disclosure with no data modification or denial of service. SSVC corroborates this: Automatable=yes means scripted mass scanning is feasible, but Technical Impact=partial and Exploitation=none cap the operational urgency. EPSS at 0.14% (4th percentile) is notably low given the zero-authentication requirement, which likely reflects the niche deployment footprint of this commercial Joomla extension rather than difficulty of exploitation. The researcher blog post references '23 critical vulnerabilities' in a single disclosure, potentially implying that this CVE is one of a cluster; the individual CVSS of 5.3 versus the researcher's 'critical' label is a signal discrepancy that defenders should note - the researcher may be assessing cumulative or chain-exploitation potential. No KEV listing and no POC code confirmed at time of analysis means immediate patch urgency is moderate rather than emergency.

An unauthenticated attacker scans for Joomla installations running the Gridbox extension, then sends crafted HTTP GET or POST requests to one or more of the extension's vulnerable endpoints with manipulated file path parameters. The server returns filesystem content - potentially including Joomla configuration files (configuration.php), environment files, or other sensitive server-side data - directly in the HTTP response. Given SSVC Automatable=yes, this is amenable to bulk scanning across internet-facing Joomla sites.