CVE-2026-65885
A Joomla extension called Gridbox from balbooa.com allows authenticated users to upload any file. If an attacker can create an account, they can use this flaw together with another vulnerability (CVE-2026-65884) to run code on the server. The flaw is serious because it requires only an authenticated user and can lead to full control of the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla extension Gridbox versions earlier than 2.20.2, distributed by balbooa.com.
Real-world impact
An attacker who can log in or create an account can upload malicious files. When combined with CVE-2026-65884, this can give the attacker the ability to execute arbitrary code on the web server, potentially taking over the entire site.
Why this severity
The CVSS score of 9.4 reflects that the vulnerability is exploitable by authenticated users with high privileges, allows arbitrary file upload (high confidentiality, integrity, availability impact), and can lead to remote code execution when paired with another flaw. The high score indicates a critical risk to affected systems.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources