CVE-2026-65886 PUBLISHED

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Assigner: Joomla
Reserved: 23.07.2026 Published: 29.07.2026 Updated: 29.07.2026

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS Score: 9.2

Product Status

Vendor balbooa.com
Product Gridbox extension for Joomla
Versions Default: unaffected
  • Version 1.0.0-2.20.1 is affected

Credits

  • Phil Taylor finder
  • Pascal Lohmann finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory CWE