CVE-2026-65889 CRITICAL

CVE-2026-65889: Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Vendor Balbooa.com
Product Gridbox extension for Joomla
Weakness CWE-284
Published July 29, 2026
Last update July 29, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y

What the vulnerability does

01Description

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

Explanation of Vulnerability in Simple Terms

02Summary

The Gridbox extension for Joomla contains an access control flaw that allows unauthenticated attackers to modify site data or disrupt service availability. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a patched version as soon as it becomes available.

What an attacker can do

03Attacker Capabilities

Modify site data or cause the site to become unavailable without logging in.

Potential impact on your site

04Site Impact

Attackers can alter content, settings, or cause downtime on your Joomla site without needing valid credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 29, 2026 CVE published
July 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion CVE-2026-2592 Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2