Is CVE-2026-65885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65885 being exploited in the wild.

How severe is CVE-2026-65885?

Informational severity, with a CVSS score of 9.4, published 29 July 2026.

Is there a fix for CVE-2026-65885?

A patch was published on 2026-07-29: Vendor released version 2.20.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65885 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65885?

Check whether you run Balbooa Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65885: Balbooa Gridbox for Joomla authenticated arbitrary file upload

CVE-2026-65885 · Severity: info · CVSS 9.4 · Published 2026-07-29

Gridbox, a popular website builder extension for the Joomla content management system, contains a security flaw in its file upload functionality. An authenticated user can upload malicious files to the server, which could lead to a complete takeover of the website. If combined with other known vulnerabilities that allow for unauthorized account creation, this could result in a total system compromise by an external attacker.

Technologies: Balbooa Gridbox. Vendors: Balbooa.

Quick answers

Is CVE-2026-65885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65885 being exploited in the wild.
How severe is CVE-2026-65885?: Informational severity, with a CVSS score of 9.4, published 29 July 2026.
Which products and versions are affected?: Balbooa Gridbox 1.0.0-2.20.1.
Is there a fix for CVE-2026-65885?: A patch was published on 2026-07-29: Vendor released version 2.20.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65885 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65885?: Check whether you run Balbooa Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability (CWE-434) exists in the Balbooa Gridbox extension for Joomla in versions prior to 2.20.2. The file upload methods fail to properly validate file extensions or content, allowing an authenticated attacker with high privileges to upload arbitrary files, such as PHP scripts, to the web server. While the vulnerability requires authentication (PR:H), it can be escalated to a full Remote Code Execution (RCE) chain if combined with CVE-2026-65884, which may allow an attacker to create the necessary account. The issue is resolved in version 2.20.2.

Affected products

balbooa.com Gridbox extension for Joomla (com_gridbox) 1.0.0-2.20.1

Timeline

2026-07-29: advisory: NVD publication date
2026-07-29: patched: Vendor released version 2.20.2 to address the issue

References

https://www.balbooa.com/gridbox

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.