Is my site affected?
Your site is affected if it runs Gridbox in any of these ranges:
- from 2.20.3.1 up to but not including 2.20.4.0
- from 2.20.2.3 up to but not including 2.20.3.1
- from 2.20.2 up to but not including 2.20.2.3
- before 2.20.2
- Latest safe version
- 2.20.4.0 or later. No rule we check matches that release or any newer one.
- What to do
- Update Gridbox to 2.20.4.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass (CVE-2026-65884, CVE-2026-65885 and others, actively exploited, fixed in 2.20.2)
A full security audit of Gridbox (component com_gridbox) found 23 vulnerabilities, including an unauthenticated arbitrary file upload that yields remote code execution in a single request, multiple unauthenticated SQL injection points (one returns every user password hash), several routes to administrator access with no password, and a registration flaw that lets any visitor create an administrator account. Several are being actively exploited in the wild, confirmed by the Joomla Security Strike Team and observed by us in server logs and on compromised sites. The Joomla CNA has assigned CVE IDs grouped by shared root cause rather than one per finding. Published so far: CVE-2026-65884 (registration accepts user-supplied group IDs, so an anonymous visitor can register with administrator permissions; CWE-284; CVSS 4.0 10.0 Critical; exploit maturity Attacked) and CVE-2026-65885 (authenticated arbitrary file upload, which becomes remote code execution when chained with CVE-2026-65884 because the attacker can create the account it needs; CWE-434; CVSS 4.0 9.4 Critical; exploit maturity Attacked). Nine further IDs are reserved and not yet public: CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65889, CVE-2026-65890, CVE-2026-65947, CVE-2026-66488, CVE-2026-66489 and CVE-2026-66490. A separate earlier authentication bypass, CVE-2026-61425, was fixed in 2.20.1. Fixed in the Gridbox 2.20.2 security release (29 July 2026): update every Gridbox site now. Every version before it, 1.0.0 to 2.20.1, is affected. Any site that has run an affected version may already be compromised: check for unexpected administrator accounts (in any group, not just Super Users), new or modified files, and PHP files in upload folders, and rotate administrator credentials. fix.mysites.guru can clean a compromised site (GBP 120, a single fixed fee, usually same day).
Affected versions: < 2.20.2
Full advisory: our disclosure post
Gridbox (com_gridbox) 2.20.3.1 to 2.20.3.x - Language Installation CSRF and Image Preview Path Validation (fixed in 2.20.4.0)
Balbooa released Gridbox 2.20.4.0 on 8 October 2026 with two security fixes: a Cross-Site Request Forgery (CSRF) vulnerability in the language installation process, and improved file path validation in the image preview so images can only be read from inside the configured media directory. The CSRF flaw is in an administrator-only action, so it needs a logged-in Super User to be tricked into opening a crafted link or page; because that action installs software, the consequence is serious even though it cannot be triggered by an anonymous visitor alone. We confirmed both changes by comparing the public 2.20.4.0 package with earlier releases; both affected areas are present from 2.20.2 onwards. Reported by Sergiy Tryzhychynskyi, coordinated by the Joomla Security Strike Team. Not a mySites.guru finding. No CVE had been assigned at the time of writing; the severity shown is our own assessment, not an official CVSS score. Update to 2.20.4.0. Earlier versions are covered by separate rules with more serious advisories, and should also go straight to 2.20.4.0.
Affected versions: ≥ 2.20.3.1 and < 2.20.4.0
Full advisory: our disclosure post
High2026-09-21
Gridbox (com_gridbox) 2.20.2.3 to 2.20.3 - Unauthenticated Time-Based SQL Injection (author parameter, fixed in 2.20.3.1)
Gridbox 2.20.3.1 fixes a time-based (blind) SQL injection in the front-end blog "author" parameter. The value was interpolated directly into a WHERE clause in the component router (verified by diffing the 2.20.3.1 release against 2.20.3: the author, tag, app and id parameters are now cast with (int)). The blog author filter is reachable on the public front end, so exploitation does not require authentication. Versions 2.20.2.3 and 2.20.3 are affected; earlier versions are covered by separate rules (the 2.20.2 mega-disclosure and the 2.20.2.3 hardening). Update to 2.20.4.0 (the current release, which also fixes two later security issues). Reported by Studio Przy Lesie and CERT PL (NASK). No CVE had been assigned at the time of writing; the severity shown is our own assessment of an unauthenticated blind SQL injection, not an official CVSS score.
Affected versions: ≥ 2.20.2.3 and < 2.20.3.1
Full advisory: www.balbooa.com
2026-08-10
Gridbox (com_gridbox) 2.20.2 to 2.20.2.2 - Undisclosed Security Hardening (media manager access control, path validation and password recovery tokens, fixed in 2.20.2.3)
Balbooa released Gridbox 2.20.2.3 on 10 August 2026 as a "Bug Fixes and Security Hardening" release. It names four security areas without describing the underlying flaws: improved authorization, request handling and access controls in the media manager; improved path validation and safeguards for internal file and directory operations; improved password recovery flows and token validation; and unspecified additional safeguards in internal components. Balbooa has published no CVE, no severity, no affected version range, and no statement of whether any of it can be reached without a login, so the seriousness cannot be judged from outside. These are not mySites.guru findings and we have not audited 2.20.2.3. Update to 2.20.4.0 (the current release, which also fixes later security issues). NOTE: this rule covers only the undisclosed hardening. Versions below 2.20.2 are affected by a far more serious set of actively exploited flaws carrying eleven CVEs, covered by a separate rule - see https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/
Affected versions: ≥ 2.20.2 and < 2.20.2.3
Full advisory: www.balbooa.com
Each CVE page above links its official cve.org record and its NVD entry.
Running Gridbox on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
CVE identifiers: CVE-2026-61425, CVE-2026-65884, CVE-2026-65885, CVE-2026-65889, CVE-2026-65890, CVE-2026-66488, CVE-2026-66489, CVE-2026-66490, CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65947, CVE-2026-102783, CVE-2026-102784. Rules current as of 25 October 2026.
