PatchTheCVEgridbox vulnerabilities and fixes
Recent CVEs affecting gridbox, with upgrade or downgrade steps. 11 tracked.
gridbox has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-07-29. Highest priority: CVE-2026-65884 (score 53/100).
- CVE-2026-65884 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows use
- CVE-2026-65887 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassw
- CVE-2026-65888 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method a
- CVE-2026-65890 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors all
- CVE-2026-65886 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer al
- CVE-2026-65885 HIGH 8.8 UPGRADE Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods
- CVE-2026-65889 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp me
- CVE-2026-66488 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
- CVE-2026-66489 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
- CVE-2026-65947 HIGH 7.3 UPGRADE Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
- CVE-2026-66490 MEDIUM 6.1 UPGRADE Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
FAQ
How do I fix gridbox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gridbox being exploited right now?
None of the tracked gridbox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gridbox CVE should I patch first?
CVE-2026-65884 currently ranks highest (53/100): Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows use.