Path Traversal Vulnerability in Gridbox by Balbooa

CVE-2026-102783

What is CVE-2026-102783?

The Gridbox extension by Balbooa contains a path traversal vulnerability that allows an attacker to manipulate the file paths used in the image preview feature. Specifically, the showImage action resolves a request-controlled path and can unintentionally reference files from sibling directories, such as images-backup, circumventing the intended restrictions. This behavior occurs when image decoding fails or is unavailable, enabling unauthorized access to sensitive images outside the configured media root. While the extension limits file access through specific image types, the potential for exploitation exists, highlighting a security concern that requires attention.

References