# CVE-2026-65885: Balbooa Gridbox for Joomla authenticated arbitrary file upload

Source: https://junglewise.ai/threats/cve-2026-65885-balbooa-gridbox-for-joomla-authenticated-arbitrary-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-65885 · Severity: info · CVSS 9.4 · Published 2026-07-29

Gridbox, a popular website builder extension for the Joomla content management system, contains a security flaw in its file upload functionality. An authenticated user can upload malicious files to the server, which could lead to a complete takeover of the website. If combined with other known vulnerabilities that allow for unauthorized account creation, this could result in a total system compromise by an external attacker.

Technologies: [Balbooa Gridbox](https://junglewise.ai/threats/technologies/gridbox). Vendors: [Balbooa](https://junglewise.ai/threats/vendors/balbooa).

## Quick answers

**Is CVE-2026-65885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65885 being exploited in the wild.

**How severe is CVE-2026-65885?** Informational severity, with a CVSS score of 9.4, published 29 July 2026.

**Which products and versions are affected?** Balbooa Gridbox 1.0.0-2.20.1.

**Is there a fix for CVE-2026-65885?** A patch was published on 2026-07-29: Vendor released version 2.20.2 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65885 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65885?** Check whether you run Balbooa Gridbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability (CWE-434) exists in the Balbooa Gridbox extension for Joomla in versions prior to 2.20.2. The file upload methods fail to properly validate file extensions or content, allowing an authenticated attacker with high privileges to upload arbitrary files, such as PHP scripts, to the web server. While the vulnerability requires authentication (PR:H), it can be escalated to a full Remote Code Execution (RCE) chain if combined with CVE-2026-65884, which may allow an attacker to create the necessary account. The issue is resolved in version 2.20.2.

## Affected products

- balbooa.com Gridbox extension for Joomla (com_gridbox) 1.0.0-2.20.1

## Timeline

- 2026-07-29: advisory: NVD publication date
- 2026-07-29: patched: Vendor released version 2.20.2 to address the issue

## References

- [https://www.balbooa.com/gridbox](https://www.balbooa.com/gridbox)

## Related threats

- [Balbooa Gridbox stored XSS in reviews](https://junglewise.ai/threats/cve-2026-107903-joomla-extension-balbooa-com-stored-xss-in-reviews-via)
- [balbooa Gridbox unauthenticated arbitrary file deletion via path traversal](https://junglewise.ai/threats/cve-2026-107129-joomla-extension-balbooa-com-unauthenticated-arbitrary-file)
- [Joomla Gridbox extension SQL injection in product sorting](https://junglewise.ai/threats/cve-2026-102788-joomla-extension-balbooa-com-unauthenticated-sql-injection-in)
- [Balbooa Gridbox CSRF in administrative interface](https://junglewise.ai/threats/cve-2026-65947-balbooa-gridbox-csrf-in-administrative-interface)
- [Balbooa Gridbox account takeover via socialLogin method](https://junglewise.ai/threats/cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method)