Alex Joseph
A significant security flaw has been identified in Balbooa’s Gridbox, a popular drag-and-drop page builder for Joomla. This vulnerability, identified as CVE-2026-65886, allows unauthorized individuals to access and read arbitrary files on a server running affected versions of the extension. This means attackers can potentially view sensitive system files or configuration data without needing any login credentials.
The arbitrary file read vulnerability is just one of many issues discovered during a comprehensive security audit. This audit, initiated by Balbooa itself after an earlier critical finding, revealed a staggering 23 distinct vulnerabilities in Gridbox. These included highly severe flaws like remote code execution (RCE) and multiple unauthenticated SQL injection points, some of which could even lead to full administrator account takeover and exposure of all user password hashes. Several of these issues are currently being actively exploited in the wild.
CVE Details
Product: Balbooa Gridbox (Joomla Extension)
CVE ID: CVE-2026-65886
Published Date: July 29, 2026
Severity: High
Status: Analyzed
Affected Products
The vulnerability affects Balbooa Gridbox versions prior to 2.20.2. The official CVE records list the affected range as 1.0.0 to 2.20.1, meaning every Gridbox release up to the initial fix was vulnerable. It’s crucial to note that further security updates have since been released, making version 2.20.4.0 the recommended patch.
Current Status
This vulnerability, along with several other critical flaws in Gridbox, is unfortunately being actively exploited in the wild. Cybersecurity teams have observed exploitation attempts in server logs and detected compromised sites with planted administrator accounts. This means that merely having a patch available is not enough; site administrators must apply the fix immediately and thoroughly check their systems for signs of compromise.
Severity Level
CVE-2026-65886, concerning the unauthenticated arbitrary file read, is rated with a High severity. However, it’s part of a broader set of vulnerabilities, some of which carry a Critical CVSS 4.0 score of 10.0, the highest possible. These include a privilege escalation flaw that allows any public registrant to create an administrator account, arbitrary password resets, and social login account takeovers. The presence of actively exploited flaws (marked as “Attacked” in CVE records) underscores the extreme risk to unpatched Gridbox installations.
Possible Solutions
Given the active exploitation, immediate action is required:
- Update Immediately: Ensure your Gridbox installation is updated to the latest secure version. While Gridbox 2.20.2 was the initial fix for many of these issues, Balbooa has released further security updates. The current recommended version to install is Gridbox 2.20.4.0. You can find this update via Joomla’s Extensions updater or download it directly from your Balbooa account.
- Perform Backups: Always take a full backup of your site before applying any updates.
- Check for Compromise: After updating, it is vital to check your site for any signs of unauthorized access or malicious activity. Look for:
- Administrator accounts you did not create. Tools like rogue admin checks can help identify these.
- Unexpected PHP files in upload folders or recently modified files. A suspect content tool can assist in detecting these.
- Any unexplained logins or activities.
For detailed steps on remediation, refer to guides on fixing a hacked Joomla site.
- Rotate Credentials: If your site was running a vulnerable version, assume that your Joomla secret and other credentials may have been exposed. Change all passwords, especially for administrator accounts.
- Consider Disabling: For high-value sites that cannot be patched immediately, consider temporarily disabling Gridbox if your site’s functionality can tolerate it.
References
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
https://www.balbooa.com/gridbox
