# Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-61425 CVE-2026-61425CriticalCVSS 9.4CVE published 20 July 2026Added to mySites.guru 20 July 2026 # Gridbox (com\_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass A full security audit of Gridbox (component com\_gridbox) found 23 vulnerabilities, including an unauthenticated arbitrary file upload that yields remote code execution in a single request, multiple unauthenticated SQL injection points (one returns every user password hash), several routes to administrator access with no password, and a registration flaw that lets any visitor create an administrator account. Several are being actively exploited in the wild, confirmed by the Joomla Security Strike Team and observed by us in server logs and on compromised sites. The Joomla CNA has assigned CVE IDs grouped by shared root cause rather than one per finding. Published so far: CVE-2026-65884 (registration accepts user-supplied group IDs, so an anonymous visitor can register with administrator permissions; CWE-284; CVSS 4.0 10.0 Critical; exploit maturity Attacked) and CVE-2026-65885 (authenticated arbitrary file upload, which becomes remote code execution when chained with CVE-2026-65884 because the attacker can create the account it needs; CWE-434; CVSS 4.0 9.4 Critical; exploit maturity Attacked). Nine further IDs are reserved and not yet public: CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65889, CVE-2026-65890, CVE-2026-65947, CVE-2026-66488, CVE-2026-66489 and CVE-2026-66490. A separate earlier authentication bypass, CVE-2026-61425, was fixed in 2.20.1. Fixed in the Gridbox 2.20.2 security release (29 July 2026): update every Gridbox site now. Every version before it, 1.0.0 to 2.20.1, is affected. Any site that has run an affected version may already be compromised: check for unexpected administrator accounts (in any group, not just Super Users), new or modified files, and PHP files in upload folders, and rotate administrator credentials. fix.mysites.guru can clean a compromised site (GBP 120, a single fixed fee, usually same day). Copy citation ## Is my site affected? - **Affected** - Gridbox before 2.20.2 - **Fixed in** - 2.20.2 - **What to do** - Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-61425 is scored The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 9.4 Critical CVSS 4.0, scored by Joomla CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:H Privileges required** - High. Needs an account with elevated rights - **UI:N User interaction** - None. Nobody has to be tricked into anything ### What it does to the site - **VC:H Confidentiality** - High. Everything the site holds can be read - **VI:H Integrity** - High. Data and files can be altered at will - **VA:H Availability** - High. The site can be taken down ### What it does beyond the site - **SC:H Confidentiality** - High. Data on other systems can be read - **SI:H Integrity** - High. Other systems can be altered - **SA:H Availability** - High. Other systems can be taken down ## Timeline 1. 20 July 2026CVE-2026-61425 record published by its CNA 2. 20 July 2026mySites.guru check added for Gridbox (before 2.20.2) 3. 29 July 2026[We published: Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Rule details Critical[CVE-2026-61425](https://mysites.guru/vulnerabilities/CVE-2026-61425/)[CVE-2026-65884](https://mysites.guru/vulnerabilities/CVE-2026-65884/)[CVE-2026-65885](https://mysites.guru/vulnerabilities/CVE-2026-65885/)[CVE-2026-65889](https://mysites.guru/vulnerabilities/CVE-2026-65889/)[CVE-2026-65890](https://mysites.guru/vulnerabilities/CVE-2026-65890/)[CVE-2026-66488](https://mysites.guru/vulnerabilities/CVE-2026-66488/)[CVE-2026-66489](https://mysites.guru/vulnerabilities/CVE-2026-66489/)[CVE-2026-66490](https://mysites.guru/vulnerabilities/CVE-2026-66490/)[CVE-2026-65886](https://mysites.guru/vulnerabilities/CVE-2026-65886/)[CVE-2026-65887](https://mysites.guru/vulnerabilities/CVE-2026-65887/)[CVE-2026-65888](https://mysites.guru/vulnerabilities/CVE-2026-65888/)[CVE-2026-65947](https://mysites.guru/vulnerabilities/CVE-2026-65947/)2026-07-20 [Gridbox](https://mysites.guru/vulnerabilities/gridbox/) Affected versions: < 2.20.2 Full advisory: [our disclosure post](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Our disclosure post [![Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/_astro/gridbox-23-critical-vulnerabilities.CJt073iB_14mgqI.webp) ### Another 23 Critical Security Vulnerabilities in Gridbox for Joomla Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2. 29 Jul 2026 ](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Other vulnerabilities in Gridbox Updating for CVE-2026-61425 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [Gridbox](https://mysites.guru/vulnerabilities/gridbox/) Latest safe version: 2.20.4.0 - [CVE-2026-65884](https://mysites.guru/vulnerabilities/CVE-2026-65884/) Critical, before 2.20.2 - [CVE-2026-65885](https://mysites.guru/vulnerabilities/CVE-2026-65885/) Critical, before 2.20.2 - [CVE-2026-65889](https://mysites.guru/vulnerabilities/CVE-2026-65889/) Critical, before 2.20.2 - [CVE-2026-65890](https://mysites.guru/vulnerabilities/CVE-2026-65890/) Critical, before 2.20.2 - [CVE-2026-66488](https://mysites.guru/vulnerabilities/CVE-2026-66488/) Critical, before 2.20.2 - [CVE-2026-66489](https://mysites.guru/vulnerabilities/CVE-2026-66489/) Critical, before 2.20.2 - [CVE-2026-66490](https://mysites.guru/vulnerabilities/CVE-2026-66490/) Critical, before 2.20.2 - [CVE-2026-65886](https://mysites.guru/vulnerabilities/CVE-2026-65886/) Critical, before 2.20.2 [All 14 CVEs in Gridbox](https://mysites.guru/vulnerabilities/gridbox/) ## References - [CVE-2026-61425 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-61425) - [CVE-2026-61425 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-61425) - [Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## CVE-2026-61425 questions Show all Which versions are affected by CVE-2026-61425? [CVE-2026-61425](https://mysites.guru/vulnerabilities/CVE-2026-61425/) affects Gridbox before 2.20.2. The fix is in 2.20.2. How do I fix CVE-2026-61425? Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen. How severe is CVE-2026-61425? Joomla CNA scores it 9.4 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, needs an account with elevated rights and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.