CVE-2026-66489

Received Received - Intake

Unauthenticated File System Disclosure in Gridbox Joomla Extension

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Joomla! Project

Description

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-66489

Affected Vendors & Products

Vendor	Product	Version / Range
balbooa	gridbox	to 2.20.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects Joomla extensions by Balbooa.com, specifically Gridbox versions before 2.20.2. It allows unauthenticated users to disclose files on the system, meaning attackers can access sensitive files without needing to log in.

Impact Analysis

An attacker could exploit this to read sensitive files on your server, potentially exposing confidential data like configuration files, user credentials, or other critical system information. This could lead to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update Gridbox to version 2.20.2 or later to address the unauthenticated file system disclosure vulnerability.

Hi! I’m here to help you understand CVE-2026-66489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70