{"id":4347,"date":"2026-10-24T12:00:54","date_gmt":"2026-10-24T12:00:54","guid":{"rendered":"https:\/\/www.ucartz.com\/updates\/gridbox-unauthenticated-arbitrary-file-read-vulnerability-cve-2026-65886-high-severity\/"},"modified":"2026-10-24T12:00:58","modified_gmt":"2026-10-24T12:00:58","slug":"gridbox-unauthenticated-arbitrary-file-read-vulnerability-cve-2026-65886-high-severity","status":"publish","type":"post","link":"https:\/\/www.ucartz.com\/updates\/gridbox-unauthenticated-arbitrary-file-read-vulnerability-cve-2026-65886-high-severity\/","title":{"rendered":"Gridbox Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-65886) \u2014 High Severity"},"content":{"rendered":"

A significant security flaw has been identified in Balbooa\u2019s Gridbox, a popular drag-and-drop page builder for Joomla. This vulnerability, identified as CVE-2026-65886, allows unauthorized individuals to access and read arbitrary files on a server running affected versions of the extension. This means attackers can potentially view sensitive system files or configuration data without needing any login credentials.<\/p>\n

The arbitrary file read vulnerability is just one of many issues discovered during a comprehensive security audit. This audit, initiated by Balbooa itself after an earlier critical finding, revealed a staggering 23 distinct vulnerabilities in Gridbox. These included highly severe flaws like remote code execution (RCE) and multiple unauthenticated SQL injection points, some of which could even lead to full administrator account takeover and exposure of all user password hashes. Several of these issues are currently being actively exploited in the wild.<\/p>\n

CVE Details<\/h2>\n

Product:<\/strong> Balbooa Gridbox (Joomla Extension)<\/p>\n

CVE ID:<\/strong> CVE-2026-65886<\/p>\n

Published Date:<\/strong> July 29, 2026<\/p>\n

Severity:<\/strong> High<\/p>\n

Status:<\/strong> Analyzed<\/p>\n

Affected Products<\/h2>\n

The vulnerability affects Balbooa Gridbox versions prior to 2.20.2<\/strong>. The official CVE records list the affected range as 1.0.0 to 2.20.1, meaning every Gridbox release up to the initial fix was vulnerable. It’s crucial to note that further security updates have since been released, making version 2.20.4.0 the recommended patch.<\/p>\n

Current Status<\/h2>\n

This vulnerability, along with several other critical flaws in Gridbox, is unfortunately being actively exploited in the wild. Cybersecurity teams have observed exploitation attempts in server logs and detected compromised sites with planted administrator accounts. This means that merely having a patch available is not enough; site administrators must apply the fix immediately and thoroughly check their systems for signs of compromise.<\/p>\n

Severity Level<\/h2>\n

CVE-2026-65886, concerning the unauthenticated arbitrary file read, is rated with a High<\/strong> severity. However, it’s part of a broader set of vulnerabilities, some of which carry a Critical CVSS 4.0 score of 10.0, the highest possible. These include a privilege escalation flaw that allows any public registrant to create an administrator account, arbitrary password resets, and social login account takeovers. The presence of actively exploited flaws (marked as “Attacked” in CVE records) underscores the extreme risk to unpatched Gridbox installations.<\/p>\n

Possible Solutions<\/h2>\n

Given the active exploitation, immediate action is required:<\/p>\n

    \n
  1. Update Immediately:<\/strong> Ensure your Gridbox installation is updated to the latest secure version. While Gridbox 2.20.2 was the initial fix for many of these issues, Balbooa has released further security updates. The current recommended version to install is Gridbox 2.20.4.0<\/strong>. You can find this update via Joomla\u2019s Extensions updater or download it directly from your Balbooa account.<\/li>\n
  2. Perform Backups:<\/strong> Always take a full backup of your site before applying any updates.<\/li>\n
  3. Check for Compromise:<\/strong> After updating, it is vital to check your site for any signs of unauthorized access or malicious activity. Look for:\n