CVE-2026-65885— Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2
Quick assessment
Affected
balbooa.com Gridbox extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Balbooa Gridbox extension for Joomla是Balbooa公司的一款Joomla的Gridbox扩展插件。 Balbooa Gridbox extension for Joomla 2.20.2之前版本存在任意文件上传漏洞，该漏洞源于文件上传方法存在缺陷，可能导致认证攻击者上传任意文件。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| balbooa.com | Gridbox extension for Joomla | 1.0.0-2.20.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-65885
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
Balbooa Gridbox extension for Joomla 任意文件上传漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Balbooa Gridbox extension for Joomla是Balbooa公司的一款Joomla的Gridbox扩展插件。 Balbooa Gridbox extension for Joomla 2.20.2之前版本存在任意文件上传漏洞，该漏洞源于文件上传方法存在缺陷，可能导致认证攻击者上传任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| balbooa.com | Gridbox extension for Joomla | 1.0.0-2.20.1 | - |
|
II. Public POCs for CVE-2026-65885
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65885
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-65885 (1)
Vendor Pages for CVE-2026-65885 (1)
Same Patch Batch · balbooa.com · 2026-07-29 · 11 CVEs total
| CVE-2026-65884 | 10.0 CRITICAL | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 |
| CVE-2026-65888 | 10.0 CRITICAL | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 |
| CVE-2026-65887 | 10.0 CRITICAL | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2. |
| CVE-2026-65889 | 9.2 CRITICAL | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < |
| CVE-2026-65890 | 9.2 CRITICAL | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 |
| CVE-2026-65886 | 9.2 CRITICAL | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 |
| CVE-2026-66489 | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox | |
| CVE-2026-66488 | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 | |
| CVE-2026-66490 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridb | |
| CVE-2026-65947 | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < |
IV. Related Vulnerabilities
Same product: Gridbox extension for Joomla
-
CVE-2026-65947
Joomla Extension - balbooa.com - Various CSRF vectors in the -
CVE-2026-65888
Joomla Extension - balbooa.com - Account takeover vulnerabil -
CVE-2026-65887
Joomla Extension - balbooa.com - Unauthenticated arbitrary p -
CVE-2026-65886
Joomla Extension - balbooa.com - Unauthenticated arbitrary f -
CVE-2026-65890
Joomla Extension - balbooa.com - Unauthenticated SQL injecti
Same vendor: balbooa.com
-
CVE-2026-102424
Joomla Extension - balbooa.com - Unauthenticated path traver -
CVE-2026-102425
Joomla Extension - balbooa.com - Unauthenticated RCE via fie -
CVE-2026-101126
Joomla Extension - balbooa.com - File meta data tampering in -
CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of At -
CVE-2026-101127
Joomla Extension - balbooa.com - Unauthenticated upload file
Same weakness: CWE-434
-
CVE-2026-92532
Unrestricted Upload of File with Dangerous Type in BugTracke -
CVE-2026-105868
Payload: Uploaded XML files could execute same-origin JavaSc -
CVE-2026-104069
HortusFox < 6.2 Remote Code Execution via Theme Import -
CVE-2026-39770
WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vu -
CVE-2026-39759
WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upl
V. Comments for CVE-2026-65885
No comments yet