What is the CVSS score of CVE-2026-66489?

CVE-2026-66489 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Gridbox CVE-2026-66489

EUVD-2026-50336 MEDIUM

Information Exposure (CWE-200)

2026-07-29 Joomla

GHSA-rghf-6cq9-v3pv

Information Disclosure Gridbox Extension For Joomla

5.3

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network-reachable endpoints return filesystem data; confidentiality impact is limited (partial disclosure), with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:37 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

5.3 (MEDIUM)

CVE Published

Jul 29, 2026 - 13:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

AnalysisAI

Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.

Technical ContextAI

Gridbox is a commercial page-builder and grid-layout extension for the Joomla CMS, developed by balbooa.com, identified by CPE cpe:2.3:a:balbooa.com:gridbox_extension_for_joomla:*:*:*:*:*:*:*:*. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning one or more HTTP-accessible endpoints within the extension process user-supplied input - likely file paths or identifiers - without adequate authorization checks, and return filesystem contents in responses. The plural 'various' in the CVE description and the researcher blog post title referencing '23 critical vulnerabilities' strongly suggest multiple distinct disclosure vectors exist within the extension, rather than a single parameter. Joomla extensions are PHP-based server-side components that can directly interact with the filesystem via functions such as file_get_contents(), readfile(), or directory listing APIs when improperly guarded.

RemediationAI

Upgrade Gridbox to version 2.20.2 or later, which is the vendor-released patch as established by the affected version range (1.0.0-2.20.1) and the CVE title boundary. Reference the vendor product page at https://www.balbooa.com/gridbox and the researcher disclosure at https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/ for full vulnerability scope - given the report references 23 vulnerabilities, administrators should confirm whether additional CVEs from the same disclosure affect their installation. If immediate upgrade is not possible, a compensating control is to restrict public HTTP access to Gridbox-specific AJAX endpoints and file-serving routes via Joomla's .htaccess or a WAF rule; however, the specific vulnerable routes are not confirmed in available data, so this workaround has uncertain coverage. Disabling the extension entirely eliminates exposure with the trade-off of losing page-builder functionality.