CVE-2026-102784
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Joomla extension Gridbox (by balbooa.com) below version 2.20.4.0 contains a CSRF vulnerability in the language installation feature because the addLanguage action does not require POST and does not validate the session token.
Risk Assessment
An attacker could trick a privileged user into performing unauthorized language installation operations, potentially leading to unwanted configuration changes.
Recommendation
Upgrade Gridbox to version 2.20.4.0 or later, which includes a fix enforcing session token validation.
Other vulnerabilities in Gridbox
See all- CVE-2026-65888Critical
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
- CVE-2026-65887Critical
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.
- CVE-2026-65890Critical
Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.
- CVE-2026-65884Critical
Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.
- CVE-2026-61425Critical
The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.
- CVE-2026-102783Medium
Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.
- CVE-2026-65947High
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.
- CVE-2026-65886High
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.
- CVE-2026-66490Medium
Joomla Extension - balbooa.com - contains a stored cross-site scripting vulnerability via a comment avatar in Gridbox before version 2.20.2.
- CVE-2026-66489Medium
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various unauthenticated file system disclosure vectors.
Original NVD description (English source)
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS