# Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-66488 CVE-2026-66488MediumCVSS 5.3CVE published 29 July 2026Added to mySites.guru 20 July 2026 # Gridbox (com\_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass A full security audit of Gridbox (component com\_gridbox) found 23 vulnerabilities, including an unauthenticated arbitrary file upload that yields remote code execution in a single request, multiple unauthenticated SQL injection points (one returns every user password hash), several routes to administrator access with no password, and a registration flaw that lets any visitor create an administrator account. Several are being actively exploited in the wild, confirmed by the Joomla Security Strike Team and observed by us in server logs and on compromised sites. The Joomla CNA has assigned CVE IDs grouped by shared root cause rather than one per finding. Published so far: CVE-2026-65884 (registration accepts user-supplied group IDs, so an anonymous visitor can register with administrator permissions; CWE-284; CVSS 4.0 10.0 Critical; exploit maturity Attacked) and CVE-2026-65885 (authenticated arbitrary file upload, which becomes remote code execution when chained with CVE-2026-65884 because the attacker can create the account it needs; CWE-434; CVSS 4.0 9.4 Critical; exploit maturity Attacked). Nine further IDs are reserved and not yet public: CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65889, CVE-2026-65890, CVE-2026-65947, CVE-2026-66488, CVE-2026-66489 and CVE-2026-66490. A separate earlier authentication bypass, CVE-2026-61425, was fixed in 2.20.1. Fixed in the Gridbox 2.20.2 security release (29 July 2026): update every Gridbox site now. Every version before it, 1.0.0 to 2.20.1, is affected. Any site that has run an affected version may already be compromised: check for unexpected administrator accounts (in any group, not just Super Users), new or modified files, and PHP files in upload folders, and rotate administrator credentials. fix.mysites.guru can clean a compromised site (GBP 120, a single fixed fee, usually same day). Copy citation ## Is my site affected? - **Affected** - Gridbox before 2.20.2 - **Fixed in** - 2.20.2 - **What to do** - Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-66488 is scored The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 5.3 Medium CVSS 3.1, scored by CISA-ADP `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **PR:N Privileges required** - None. No account needed - **UI:N User interaction** - None. Nobody has to be tricked into anything - **S:U Scope** - Unchanged. Contained to the extension it is in ### What it does - **C:N Confidentiality** - None. Nothing can be read - **I:L Integrity** - Low. Some data can be altered - **A:N Availability** - None. The site stays up The rule below is rated Critical for the set of 12 CVEs it covers together, not for this record on its own. ## Timeline 1. 20 July 2026mySites.guru check added for Gridbox (before 2.20.2) 2. 29 July 2026CVE-2026-66488 record published by its CNA 3. 29 July 2026[We published: Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Rule details Critical[CVE-2026-61425](https://mysites.guru/vulnerabilities/CVE-2026-61425/)[CVE-2026-65884](https://mysites.guru/vulnerabilities/CVE-2026-65884/)[CVE-2026-65885](https://mysites.guru/vulnerabilities/CVE-2026-65885/)[CVE-2026-65889](https://mysites.guru/vulnerabilities/CVE-2026-65889/)[CVE-2026-65890](https://mysites.guru/vulnerabilities/CVE-2026-65890/)[CVE-2026-66488](https://mysites.guru/vulnerabilities/CVE-2026-66488/)[CVE-2026-66489](https://mysites.guru/vulnerabilities/CVE-2026-66489/)[CVE-2026-66490](https://mysites.guru/vulnerabilities/CVE-2026-66490/)[CVE-2026-65886](https://mysites.guru/vulnerabilities/CVE-2026-65886/)[CVE-2026-65887](https://mysites.guru/vulnerabilities/CVE-2026-65887/)[CVE-2026-65888](https://mysites.guru/vulnerabilities/CVE-2026-65888/)[CVE-2026-65947](https://mysites.guru/vulnerabilities/CVE-2026-65947/)2026-07-20 [Gridbox](https://mysites.guru/vulnerabilities/gridbox/) Affected versions: < 2.20.2 Full advisory: [our disclosure post](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Our disclosure post [![Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/_astro/gridbox-23-critical-vulnerabilities.CJt073iB_14mgqI.webp) ### Another 23 Critical Security Vulnerabilities in Gridbox for Joomla Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2. 29 Jul 2026 ](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## Other vulnerabilities in Gridbox Updating for CVE-2026-66488 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [Gridbox](https://mysites.guru/vulnerabilities/gridbox/) Latest safe version: 2.20.4.0 - [CVE-2026-61425](https://mysites.guru/vulnerabilities/CVE-2026-61425/) Critical, before 2.20.2 - [CVE-2026-65884](https://mysites.guru/vulnerabilities/CVE-2026-65884/) Critical, before 2.20.2 - [CVE-2026-65885](https://mysites.guru/vulnerabilities/CVE-2026-65885/) Critical, before 2.20.2 - [CVE-2026-65889](https://mysites.guru/vulnerabilities/CVE-2026-65889/) Critical, before 2.20.2 - [CVE-2026-65890](https://mysites.guru/vulnerabilities/CVE-2026-65890/) Critical, before 2.20.2 - [CVE-2026-66489](https://mysites.guru/vulnerabilities/CVE-2026-66489/) Critical, before 2.20.2 - [CVE-2026-66490](https://mysites.guru/vulnerabilities/CVE-2026-66490/) Critical, before 2.20.2 - [CVE-2026-65886](https://mysites.guru/vulnerabilities/CVE-2026-65886/) Critical, before 2.20.2 [All 14 CVEs in Gridbox](https://mysites.guru/vulnerabilities/gridbox/) ## References - [CVE-2026-66488 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-66488) - [CVE-2026-66488 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-66488) - [Another 23 Critical Security Vulnerabilities in Gridbox for Joomla](https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/) ## CVE-2026-66488 questions Show all Which versions are affected by CVE-2026-66488? [CVE-2026-66488](https://mysites.guru/vulnerabilities/CVE-2026-66488/) affects Gridbox before 2.20.2. The fix is in 2.20.2. How do I fix CVE-2026-66488? Update Gridbox to 2.20.2 for this flaw, or to 2.20.4.0 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen. How severe is CVE-2026-66488? CISA-ADP scores it 5.3 (Medium) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.