Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass (CVE-2026-65884, CVE-2026-65885 and others, actively exploited, fixed in 2.20.2)
Affected versions: < 2.20.2
Gridbox security vulnerabilities
mySites.guru tracks 2vulnerabilities in com_gridbox. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.
What we check for
2026-08-10
Gridbox (com_gridbox) 2.20.2 to 2.20.2.2 - Undisclosed Security Hardening (media manager access control, path validation and password recovery tokens, fixed in 2.20.2.3)
Affected versions: ≥ 2.20.2 and < 2.20.2.3
What we have written about Gridbox
Another 23 Critical Security Vulnerabilities in Gridbox for Joomla
Balbooa asked us to audit Gridbox. We found 23 vulnerabilities, including a pre-auth RCE in one request. Several are being actively exploited in the wild, and the complete fix is now out in Gridbox 2.20.2. Update every Gridbox site immediately.
Gridbox for Joomla: One Cookie and You Are a Super User
A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.
Running Gridbox on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-61425. Rules current as of 24 August 2026.