CVE Catalog
CVE-2026-65885
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk0.25%
17th percentile - higher than 17% of all known CVEs
Summary
Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an authenticated attacker to upload arbitrary files. Combined with CVE-2026-65884, it can lead to remote code execution (RCE).
Risk Assessment
An attacker can upload a malicious file, which combined with privilege escalation can lead to full server compromise.
Recommendation
Update Gridbox to version 2.20.2 or later.
Original NVD description (English source)
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.