Pascal Lohmann

**Name of the Vulnerable Software and Affected Versions** Gridbox versions prior to 2.20.2 **Description** A privilege escalation issue exists in the registration method of the Gridbox extension for Joomla. This flaw allows unauthenticated actors to register new accounts with administrative permissions by providing specific usergroup IDs. **Recommendations** Update Gridbox to version 2.20.2 or later.

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.