Gridbox 2.20.4.0 Fixes a Language Install CSRF and an Image Path Check

TL;DR

Balbooa released Gridbox 2.20.4.0 on 8 October 2026 with two security fixes for the Joomla page builder. The bigger one is a Cross-Site Request Forgery (CSRF) flaw in the language installation process. The smaller one tightens the path check in the image preview so it only serves images from the configured media folder.

The version most Gridbox sites run today, 2.20.3.1, is affected, and so is every build before it. Update to 2.20.4.0. The Joomla CNA published a CVE for each flaw later the same day: CVE-2026-102784 for the CSRF, scored 8.7 High, and CVE-2026-102783 for the path check, scored 6.3 Medium. High matches our own call, because the CSRF flaw ends with software installed on the site, even though it needs a Super User to be tricked into it.

The language installation CSRF

Gridbox lets an administrator install extra interface languages from inside the component. Installing a language means installing a Joomla package, which is the same machinery that installs any extension, so the action is limited to Super Users.

Cross-Site Request Forgery is an attack on the person rather than the server. The attacker cannot log in, so instead they get someone who already is to send a request on their behalf, usually by getting them to open a link or visit a page while their admin session is live. Joomla’s defence is a per-session token that every state-changing request must include. A request forged from another site does not have the token, so Joomla rejects it.

Gridbox 2.20.2 added that token check across its admin controllers as part of fixing the 23 vulnerabilities from our July audit. The language installation action had a route around that check. According to the CVE record, the shared token check only ran when the request was a POST, and the language install action accepted a GET, so a plain link reached it with no token at all. 2.20.4.0 closes that path, so the token check now covers the language install as well.

The image preview path check

The second fix is narrower. Gridbox’s image preview serves an image from the site so the editor can show it, and it is meant to stay inside the media folder configured in Gridbox. The containment check in 2.20.2 to 2.20.3.1 was looser than intended, and in some folder layouts it accepted image paths outside that folder. 2.20.4.0 makes the comparison exact.

The preview only serves Gridbox image file types, so configuration.php and other PHP files were not reachable through it. The CVE record adds one detail: if the server cannot decode the image, the preview streams the file as it is, which is why the record treats it as a file read at all. In practice it needs a folder beside the media folder whose name starts the same way, such as images-backup, with images in it you did not mean to publish. It tightens the containment added in July.

Which Gridbox versions are affected?

Both CVE records list every release from 1.0.0 to 2.20.3.1 as affected. We also compared the public 2.20.4.0 package with 2.20.3 and 2.20.2.2, and both of the changed areas are present from 2.20.2 onwards. Our newest rule flags 2.20.3.1 with both CVE numbers, and the existing rules for earlier ranges already flag every older build and point to 2.20.4.0 as the version to install.

Sites on the Joomla 3 line top out at Gridbox 2.17.0.2, which has no fix for any of this year’s flaws. For those sites the fix is moving to a supported Joomla.

What you should do right now

1. Update Gridbox to 2.20.4.0 on every Joomla site that runs it, through Joomla’s Update tab or the mySites.guru mass updater.
2. Confirm the version afterwards. Open System, Manage, Extensions and check Gridbox reads 2.20.4.0.
3. Check for extensions you did not install. If you are worried a Super User on one of your sites opened something they should not have, look at the extensions list for anything unexpected, and at administrator accounts you did not create.
4. If you use Facebook login, generate a new App ID and App Secret. Balbooa reworked the integration for Facebook’s API changes, so the old ones will not work.
5. Check your image compression settings. They have moved from Media Manager settings to Performance Tools, Images, and now apply to image uploads anywhere in Gridbox.

How do I find every Gridbox site I manage?

mySites.guru keeps a live inventory of the extensions on each connected Joomla and WordPress site. Search for Gridbox once and you get the sites running it, the version each is on and whether an update is waiting. Across the Joomla sites we monitor, several hundred run Gridbox, and the large majority were on 2.20.3.1 on the morning of the release.

We have added 2.20.3.1 to our vulnerability database, so connected sites still on it are flagged automatically, and the mass updater pushes 2.20.4.0 to all of them from one screen. That is part of the subscription, not a separate purchase.

Four Gridbox security releases since July

2.20.1 fixed the cookie authentication bypass in July. 2.20.2 fixed the 23 flaws from our audit at the end of that month. 2.20.3.1 fixed the blog author SQL injection three weeks ago. 2.20.4.0 is the fourth, and both of its fixes are follow-ups to protections that 2.20.2 introduced: the CSRF token check and the image path containment.

That pattern is normal once a large codebase gets serious attention. The first round of fixes adds the right protections, and outside researchers then find the corners those protections missed. The sites that get hurt are the ones that stopped updating after the first round. If your Gridbox sites went to 2.20.3.1 three weeks ago, they need updating again today.

Disclosure and severity

This is not a mySites.guru finding. Balbooa credits Sergiy Tryzhychynskyi for reporting both issues, and David Jardin of the Joomla Security Strike Team for coordinating the disclosure. Sergiy also reported part of the Balbooa Forms 2.4.3.4 fixes last month.

Balbooa’s note gave no CVE, no score and no affected range. The Joomla CNA filled that in a few hours later with CVE-2026-102784 (CSRF, CVSS 4.0 8.7 High) and CVE-2026-102783 (path traversal, CVSS 4.0 6.3 Medium), both listing every release up to 2.20.3.1. We had set our rule from the code before the records existed, so connected sites were flagged that morning, and the CVE numbers were added to the rule once they were published.

The CNA’s 8.7 matches our own call on the CSRF flaw: it needs a signed-in Super User to cooperate unknowingly, which keeps it below Critical, but success means attacker-chosen software installed on the site. The path traversal record is less consistent. Its score is 6.3 Medium, but its own description says the finding “is rated Low rather than presented as arbitrary file disclosure”. We think Low is closer to the real risk, because it needs an oddly named sibling folder of images to exist before there is anything to read. We quote the record’s score, because that is what scanners and other advisories will show you.

If a site has already been hit, or you would rather someone else made sure, fix.mySites.guru patches the site, audits it for backdoors and hands it back secure for a single fixed fee, usually the same day.