CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
What the vulnerability does
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
Explanation of Vulnerability in Simple Terms
The Gridbox extension for Joomla contains an unrestricted file upload vulnerability affecting versions 1.0.0 through 2.20.1. An authenticated administrator can upload files of dangerous types to the server. This could allow an attacker with admin privileges to upload malicious code and compromise the site.
What an attacker can do
Upload executable files or other dangerous file types to the server.
Potential impact on your site
An admin account compromise could lead to malicious file uploads and full site takeover.
Conditions required to exploit
Attacker must have administrator-level access to the Joomla site.
Key dates
External resources
Related vulnerabilities
