Skip to main content
mySites.guru
Free Audit
J!Awards 2026mySites.guru won a new 2026 award at the Joomla World ConferenceOur awards
CVE-2026-66488MediumCVSS 5.3CVE published 29 July 2026Added to mySites.guru 20 July 2026

Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass

A full security audit of Gridbox (component com_gridbox) found 23 vulnerabilities, including an unauthenticated arbitrary file upload that yields remote code execution in a single request, multiple unauthenticated SQL injection points (one returns every user password hash), several routes to administrator access with no password, and a registration flaw that lets any visitor create an administrator account. Several are being actively exploited in the wild, confirmed by the Joomla Security Strike Team and observed by us in server logs and on compromised sites. The Joomla CNA has assigned CVE IDs grouped by shared root cause rather than one per finding. Published so far: CVE-2026-65884 (registration accepts user-supplied group IDs, so an anonymous visitor can register with administrator permissions; CWE-284; CVSS 4.0 10.0 Critical; exploit maturity Attacked) and CVE-2026-65885 (authenticated arbitrary file upload, which becomes remote code execution when chained with CVE-2026-65884 because the attacker can create the account it needs; CWE-434; CVSS 4.0 9.4 Critical; exploit maturity Attacked). Nine further IDs are reserved and not yet public: CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65889, CVE-2026-65890, CVE-2026-65947, CVE-2026-66488, CVE-2026-66489 and CVE-2026-66490. A separate earlier authentication bypass, CVE-2026-61425, was fixed in 2.20.1. Fixed in the Gridbox 2.20.2 security release (29 July 2026): update every Gridbox site now. Every version before it, 1.0.0 to 2.20.1, is affected. Any site that has run an affected version may already be compromised: check for unexpected administrator accounts (in any group, not just Super Users), new or modified files, and PHP files in upload folders, and rotate administrator credentials. fix.mysites.guru can clean a compromised site (GBP 120, a single fixed fee, usually same day).

Is my site affected?

Affected
Gridbox before 2.20.2
Fixed in
2.20.2
What to do
Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches.
Check whether your sites are affected

How CVE-2026-66488 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

5.3 Medium

CVSS 3.1, scored by CISA-ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything
S:U Scope
Unchanged. Contained to the extension it is in

What it does

C:N Confidentiality
None. Nothing can be read
I:L Integrity
Low. Some data can be altered
A:N Availability
None. The site stays up

The rule below is rated Critical for the set of 12 CVEs it covers together, not for this record on its own.

Timeline

  1. 20 July 2026mySites.guru check added for Gridbox (before 2.20.2)
  2. 29 July 2026CVE-2026-66488 record published by its CNA
  3. 29 July 2026We published: Another 23 Critical Security Vulnerabilities in Gridbox for Joomla

Rule details

Our disclosure post

Another 23 Critical Security Vulnerabilities in Gridbox for Joomla

Another 23 Critical Security Vulnerabilities in Gridbox for Joomla

Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2.

Other vulnerabilities in Gridbox

Updating for CVE-2026-66488 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

Gridbox

Latest safe version: 2.20.4.0

All 14 CVEs in Gridbox

References

CVE-2026-66488 questions

Which versions are affected by CVE-2026-66488?
CVE-2026-66488 affects Gridbox before 2.20.2. The fix is in 2.20.2.
How do I fix CVE-2026-66488?
Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-66488?
CISA-ADP scores it 5.3 (Medium) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 17 October 2026.