Alex Joseph
Understanding the Threat: Joomla Gridbox Directory Deletion
A severe security flaw has been uncovered in Balbooa’s Gridbox, a popular drag-and-drop page builder for Joomla. This vulnerability, identified as CVE-2026-65889, allows an attacker to recursively delete directories on your website without needing any form of authentication. This means unauthorized individuals could potentially wipe out significant parts of your site’s content, leading to data loss and disruption.
CVE Details
This particular vulnerability affects the Joomla Extension known as Balbooa Gridbox. It specifically targets the generateNewApp method, which contains a flaw that permits unauthenticated users to perform recursive directory deletions.
- Product Name: Joomla Extension – Balbooa Gridbox
- Published: July 29, 2026
- Severity: Critical
- Status: Analyzed
Affected Products
The unauthenticated recursive directory deletion vulnerability impacts all versions of Balbooa Gridbox for Joomla prior to 2.20.2. It’s crucial to understand that if you are running any version older than 2.20.2, your website is at significant risk. The developers have since released further updates, with Gridbox 2.20.4.0 being the most current recommended version for full security fixes.
Current Status
The vulnerability has been thoroughly analyzed, and Balbooa has released patches to address it. However, the situation is urgent because this flaw, alongside several other critical issues in Gridbox, is actively being exploited in the wild. Attackers are scanning for and targeting unpatched websites, making immediate action essential to protect your Joomla site from potential harm.
Severity Level
CVE-2026-65889 is rated with a CVSS 4.0 score of 9.2, classifying it as a Critical severity vulnerability. This high score reflects the ease with which it can be exploited (no authentication required) and the devastating impact it can have. An attacker can initiate recursive directory deletion, potentially leading to complete data loss or severe defacement of your website without needing a user account or any prior access. Such an attack could render your site inoperable and cause significant reputational and financial damage.
Possible Solutions
To secure your Joomla website against this critical vulnerability and many others identified in Gridbox, follow these urgent steps:
- Update Immediately: The most crucial step is to update your Gridbox installation to version 2.20.4.0 or later without delay. You can do this through Joomla’s Extensions updater or by downloading the latest version from your Balbooa account.
- Perform Backups: Before any update, always create a full backup of your website. This ensures you have a clean restore point in case any issues arise during the update process or if your site has already been compromised.
- Check for Compromise: Given that these vulnerabilities are actively exploited, assume your site might already be affected. Look for any unauthorized administrator accounts. Tools like our Rogue Admin check can help you identify suspicious accounts across all your Joomla sites. Also, check for unexpected PHP files or modified content, which could indicate a successful attack. For more detailed guidance, refer to our guide on how to fix a hacked Joomla or WordPress site.
- Rotate Credentials: If your site was running a vulnerable version, it’s wise to rotate all sensitive credentials, including database passwords and Joomla secret keys, as they might have been exposed.
- Consider Temporary Disabling: For high-value sites that cannot be patched immediately, consider temporarily disabling the Gridbox extension if your site’s functionality allows it, until the update can be safely applied.
For a complete overview of vulnerabilities specific to Gridbox and their corresponding fixes, you can use a Joomla vulnerability scanner to keep track of your site’s security posture.
References
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
https://www.balbooa.com/gridbox
