CVE-2026-107129 · Other
NO FIX YET · SEE WHAT TO DO
Gridbox, a page builder extension for Joomla from balbooa.com, has a path traversal flaw that lets an unauthenticated visitor delete arbitrary files on the server. The sources do not describe code execution; the impact stated is arbitrary file deletion.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Gridbox extension for Joomla before version 2.20.5.0 are exposed, because an unauthenticated request can reach the file deletion path. Sites without Gridbox installed are not affected. The sources do not say which Gridbox features or URLs are involved.
Not affected if gridbox-not-installed, version-2.20.5.0-or-later
Who cares gridbox, joomla, php, self-hosted
2.20.5.0.2.20.5.0 are affected; move to 2.20.5.0 or later.Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.