{"id":"CVE-2026-107129","kind":"vulnerability","aliases":["CVE-2026-107129"],"related":[],"title":"Joomla Gridbox extension: unauthenticated path traversal deletes arbitrary files","description":"Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0","summary":"Gridbox, a page builder extension for Joomla from balbooa.com, has a path traversal flaw that lets an unauthenticated visitor delete arbitrary files on the server. The sources do not describe code execution; the impact stated is arbitrary file deletion.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gridbox","joomla","other","php","self-hosted"],"not_affected_if":["gridbox-not-installed","version-2.20.5.0-or-later"],"how_to_check":"- Check whether the Gridbox extension is installed on the Joomla site in the Joomla administrator under Extensions > Manage.\n- Note the installed Gridbox version and compare it with `2.20.5.0`.","fix":"- Gridbox versions below `2.20.5.0` are affected; move to `2.20.5.0` or later.","status":"open","published_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:25+00:00","updated_at":"2026-11-05T18:40:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T18:40:25Z","model":"claude-haiku-5-5","output":{"fix":"- Gridbox versions below `2.20.5.0` are affected; move to `2.20.5.0` or later.","reach":"internet","title":"Joomla Gridbox extension: unauthenticated path traversal deletes arbitrary files","impact":"medium","summary":"Gridbox, a page builder extension for Joomla from balbooa.com, has a path traversal flaw that lets an unauthenticated visitor delete arbitrary files on the server. The sources do not describe code execution; the impact stated is arbitrary file deletion.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","gridbox","self-hosted","php"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker deletes arbitrary files on the web server.","analyst_note":"Confirm the affected endpoint and whether deletion can reach configuration or code files; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107129 for the CVSS vector.","how_to_check":"- Check whether the Gridbox extension is installed on the Joomla site in the Joomla administrator under Extensions > Manage.\n- Note the installed Gridbox version and compare it with `2.20.5.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["gridbox-not-installed","version-2.20.5.0-or-later"],"who_is_affected":"Sites running the Gridbox extension for Joomla before version 2.20.5.0 are exposed, because an unauthenticated request can reach the file deletion path. Sites without Gridbox installed are not affected. The sources do not say which Gridbox features or URLs are involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4189,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107129':12A,15A '-2026':11A,14A '2.20.5.0':74C 'arbitrari':8A,43B,59B,66C 'balbooa.com':31B,64C 'builder':26B 'code':53B 'cve':10A,13A 'delet':7A,42B,61B,68C 'describ':52B 'execut':54B 'extens':3A,27B,63C 'file':9A,44B,60B,67C 'flaw':36B 'gridbox':2A,16B,23B,73C 'host':22B 'impact':56B 'joomla':1A,17B,29B,62C 'let':38B 'page':25B 'path':5A,34B,70C 'php':19B 'self':21B 'self-host':20B 'server':47B 'sourc':49B 'state':57B 'travers':6A,35B,71C 'unauthent':4A,40B,65C 'via':69C 'visitor':41B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gridbox extension for Joomla before version 2.20.5.0 are exposed, because an unauthenticated request can reach the file deletion path. Sites without Gridbox installed are not affected. The sources do not say which Gridbox features or URLs are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gridbox","high","joomla","other","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107129","severity":null,"published_at":"2026-11-05T18:17:00+00:00","modified_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}