Alex Joseph
Overview
The Joomla page builder extension, Gridbox, developed by Balbooa, has been found to contain a serious security flaw, identified as CVE-2026-65885. This vulnerability allows an attacker who is already logged into the system (authenticated) to upload malicious files. While this particular vulnerability requires authentication, it can be combined with another critical flaw (CVE-2026-65884) that allows attackers to create an account easily, escalating the risk to remote code execution (RCE). This means an attacker could potentially take complete control of your website. This is part of a larger discovery of 23 distinct vulnerabilities in Gridbox.
CVE Details
- Product: Gridbox for Joomla! (balbooa.com)
- Published Date: July 29, 2026
- Severity: HIGH (specifically 9.4 Critical under CVSS 4.0)
- Status: Analyzed, with active exploitation reported in the wild.
Affected Products
This vulnerability impacts all versions of Balbooa Gridbox for Joomla! prior to 2.20.2. Specifically, the CVE records indicate that versions 1.0.0 through 2.20.1 are affected.
Current Status
The situation is critical. Several vulnerabilities, including those that can be chained with CVE-2026-65885, are being actively exploited by attackers. Evidence of this includes malicious administrator accounts being created on compromised sites and exploitation attempts appearing in server logs. This active exploitation underscores the urgency for website administrators to take immediate action.
Severity Level
CVE-2026-65885 is rated as HIGH severity with a CVSS score of 8.8 (specifically 9.4 Critical under CVSS 4.0). This rating reflects the significant danger posed by the vulnerability. An authenticated attacker can upload arbitrary files, which, if combined with other flaws (like the privilege escalation in CVE-2026-65884), leads directly to remote code execution. Remote code execution is one of the most severe types of vulnerabilities, as it allows attackers to execute their own code on the affected server, potentially leading to full website takeover, data theft, or further network compromise.
Possible Solutions
Immediate action is crucial to protect your Joomla websites running Gridbox.
- Update Immediately: The most important step is to update your Balbooa Gridbox extension to version 2.20.2 or later. The latest recommended version that includes all known fixes, including follow-ups, is Gridbox 2.20.4.0. You can usually do this through Joomla’s Extensions updater or by downloading the latest version from your Balbooa account.
- Backup Your Site: Before performing any update, always create a full backup of your website. This ensures you have a clean restore point in case of any issues during the update process.
- Check for Compromise: Given the active exploitation, it’s vital to check if your site has already been compromised. Look for:
- Rogue Admin Accounts: Any administrator accounts you did not create. Tools exist to scan for these across all your Joomla sites. (Internal Backlink: Finding rogue admin accounts across every Joomla site)
- Malicious Files: Look for suspicious PHP files in web-reachable folders, which often indicate a remote code execution exploit.
- Unexpected Modifications: Check for any recently modified files that seem out of place.
- Unusual Logins: Review your site’s access logs for any login attempts or successful logins you cannot account for. (Internal Backlink: How to fix a hacked Joomla or WordPress site)
- Rotate Credentials: If your site was accessible while running a vulnerable version, assume your Joomla secret (and potentially other credentials) might be exposed. Rotate all administrative passwords and database credentials.
- Consider Disabling: For high-value sites that cannot be patched immediately, consider temporarily disabling the Gridbox extension if your site’s functionality allows, until the update can be applied.
References
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
https://www.balbooa.com/gridbox
