PT-2026-65786 · Balbooa.Com · Gridbox Extension For Joomla

Pascal Lohmann + 1 · CVE-2026-65885 · Published 2026-07-29 · Updated 2026-07-29

Mitre

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-65885

Affected Products

Gridbox Extension For Joomla

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-65885 · Security Note
• https://balbooa.com/gridbox · Note