Unauthenticated Arbitrary File Deletion in Gridbox Joomla Extension by Balbooa
CVE-2026-107129

8.3HIGH

Key Information:

Vendor

Balbooa.com

Status
Gridbox Extension For Joomla
Vendor
CVE Published:
5 November 2026

What is CVE-2026-107129?

The Gridbox Joomla Extension by Balbooa is affected by a vulnerability that allows unauthenticated users to execute arbitrary file deletion through path traversal techniques. This flaw can lead to severe consequences, including unauthorized access and potential loss of sensitive data. Users are advised to update to versions 2.20.5.0 and above to mitigate this risk.

Affected Version(s)

Gridbox extension for Joomla 1.0.0-2.20.4.2

References

https://www.balbooa.com/gridbox
product

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.