Skip to main content
mySites.guru
New features added last monthRelease RadarFile ManagerImpostor FilesUpdate QueueRogue AdminsMCP & APIJoomla VELCVE Index

Gridbox security vulnerabilities

mySites.guru tracks 2 vulnerabilities in com_gridbox. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CriticalCVE-2026-61425CVE-2026-65884CVE-2026-65885CVE-2026-65889CVE-2026-65890CVE-2026-66488CVE-2026-66489CVE-2026-66490CVE-2026-65886CVE-2026-65887CVE-2026-65888CVE-2026-659472026-07-20

Gridbox (com_gridbox) below 2.20.2 - Multiple Unauthenticated RCE, SQL Injection and Authentication Bypass (CVE-2026-65884, CVE-2026-65885 and others, actively exploited, fixed in 2.20.2)

A full security audit of Gridbox (component com_gridbox) found 23 vulnerabilities, including an unauthenticated arbitrary file upload that yields remote code execution in a single request, multiple unauthenticated SQL injection points (one returns every user password hash), several routes to administrator access with no password, and a registration flaw that lets any visitor create an administrator account. Several are being actively exploited in the wild, confirmed by the Joomla Security Strike Team and observed by us in server logs and on compromised sites. The Joomla CNA has assigned CVE IDs grouped by shared root cause rather than one per finding. Published so far: CVE-2026-65884 (registration accepts user-supplied group IDs, so an anonymous visitor can register with administrator permissions; CWE-284; CVSS 4.0 10.0 Critical; exploit maturity Attacked) and CVE-2026-65885 (authenticated arbitrary file upload, which becomes remote code execution when chained with CVE-2026-65884 because the attacker can create the account it needs; CWE-434; CVSS 4.0 9.4 Critical; exploit maturity Attacked). Nine further IDs are reserved and not yet public: CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65889, CVE-2026-65890, CVE-2026-65947, CVE-2026-66488, CVE-2026-66489 and CVE-2026-66490. A separate earlier authentication bypass, CVE-2026-61425, was fixed in 2.20.1. Fixed in the Gridbox 2.20.2 security release (29 July 2026): update every Gridbox site now. Every version before it, 1.0.0 to 2.20.1, is affected. Any site that has run an affected version may already be compromised: check for unexpected administrator accounts (in any group, not just Super Users), new or modified files, and PHP files in upload folders, and rotate administrator credentials. fix.mysites.guru can clean a compromised site (GBP 120, a single fixed fee, usually same day).

Affected versions: < 2.20.2

Full advisory: our disclosure post

2026-08-10

Gridbox (com_gridbox) 2.20.2 to 2.20.2.2 - Undisclosed Security Hardening (media manager access control, path validation and password recovery tokens, fixed in 2.20.2.3)

Balbooa released Gridbox 2.20.2.3 on 10 August 2026 as a "Bug Fixes and Security Hardening" release. It names four security areas without describing the underlying flaws: improved authorization, request handling and access controls in the media manager; improved path validation and safeguards for internal file and directory operations; improved password recovery flows and token validation; and unspecified additional safeguards in internal components. Balbooa has published no CVE, no severity, no affected version range, and no statement of whether any of it can be reached without a login, so the seriousness cannot be judged from outside. These are not mySites.guru findings and we have not audited 2.20.2.3. Update to 2.20.2.3. NOTE: this rule covers only the undisclosed hardening. Versions below 2.20.2 are affected by a far more serious set of actively exploited flaws carrying eleven CVEs, covered by a separate rule - see https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/

Affected versions: ≥ 2.20.2 and < 2.20.2.3

Full advisory: www.balbooa.com

What we have written about Gridbox

Another 23 Critical Security Vulnerabilities in Gridbox for Joomla

Another 23 Critical Security Vulnerabilities in Gridbox for Joomla

Balbooa asked mySites.guru to audit Gridbox for Joomla. We found 23 vulnerabilities, including a pre-auth RCE, some exploited already. Fixed in 2.20.2.

Gridbox for Joomla: One Cookie and You Are a Super User

Gridbox for Joomla: One Cookie and You Are a Super User

A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.

Running Gridbox on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-61425, CVE-2026-65884, CVE-2026-65885, CVE-2026-65889, CVE-2026-65890, CVE-2026-66488, CVE-2026-66489, CVE-2026-66490, CVE-2026-65886, CVE-2026-65887, CVE-2026-65888, CVE-2026-65947. Rules current as of 13 September 2026.