CVE-2026-65885
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an authenticated attacker to upload arbitrary files. Combined with CVE-2026-65884, it can lead to remote code execution (RCE).
Risk Assessment
An attacker can upload a malicious file, which combined with privilege escalation can lead to full server compromise.
Recommendation
Update Gridbox to version 2.20.2 or later.
Other vulnerabilities in Gridbox
See all- CVE-2026-65888Critical
The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.
- CVE-2026-65887Critical
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.
- CVE-2026-65890Critical
Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.
- CVE-2026-65884Critical
Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.
- CVE-2026-61425Critical
The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.
- CVE-2026-65947High
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.
- CVE-2026-65886High
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.
- CVE-2026-66490Medium
Joomla Extension - balbooa.com - contains a stored cross-site scripting vulnerability via a comment avatar in Gridbox before version 2.20.2.
- CVE-2026-66489Medium
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various unauthenticated file system disclosure vectors.
- CVE-2026-66488Medium
Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has a payment bypass vulnerability.
Original NVD description (English source)
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS