{"id":"CVE-2026-107130","kind":"vulnerability","aliases":["CVE-2026-107130"],"related":[],"title":"Joomla Gridbox extension lets anonymous users delete submission files","description":"Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0","summary":"The Gridbox extension for Joomla, made by balbooa.com, versions before 2.20.5.0, lets an unauthenticated visitor delete files uploaded through form submissions and fields. An attacker gets data loss of uploaded files without needing an account.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gridbox","joomla","other","self-hosted"],"not_affected_if":["gridbox-2.20.5.0-or-later","no-file-upload-fields"],"how_to_check":"- Check the installed Gridbox version in the Joomla administrator under Extensions > Manage.\n- Confirm whether any Gridbox forms or fields accept file uploads on the site.","fix":"- Gridbox versions below `2.20.5.0` are affected; move to `2.20.5.0` or later.","status":"open","published_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:37+00:00","updated_at":"2026-11-05T18:40:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T18:40:37Z","model":"claude-haiku-5-5","output":{"fix":"- Gridbox versions below `2.20.5.0` are affected; move to `2.20.5.0` or later.","reach":"internet","title":"Joomla Gridbox extension lets anonymous users delete submission files","impact":"medium","summary":"The Gridbox extension for Joomla, made by balbooa.com, versions before 2.20.5.0, lets an unauthenticated visitor delete files uploaded through form submissions and fields. An attacker gets data loss of uploaded files without needing an account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","gridbox","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"anonymous visitors delete uploaded submission and field files","analyst_note":"","how_to_check":"- Check the installed Gridbox version in the Joomla administrator under Extensions > Manage.\n- Confirm whether any Gridbox forms or fields accept file uploads on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["gridbox-2.20.5.0-or-later","no-file-upload-fields"],"who_is_affected":"Sites running the Gridbox extension for Joomla below 2.20.5.0 that use submission or field file uploads are exposed to unauthenticated file deletion. Sites without Gridbox, or with it at 2.20.5.0 or later, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4180,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107130':12A,15A '-2026':11A,14A '2.20.5.0':32B,67C 'account':56B 'anonym':5A 'attack':46B 'balbooa.com':29B,59C 'cve':10A,13A 'data':48B 'delet':7A,37B,61C 'extens':3A,24B,58C 'field':44B 'file':9A,38B,52B,64C 'form':41B 'get':47B 'gridbox':2A,16B,23B,66C 'host':21B 'joomla':1A,17B,26B,57C 'let':4A,33B 'loss':49B 'made':27B 'need':54B 'self':20B 'self-host':19B 'submiss':8A,42B 'submission/field':63C 'unauthent':35B,60C 'upload':39B,51B 'user':6A 'version':30B 'visitor':36B 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gridbox extension for Joomla below 2.20.5.0 that use submission or field file uploads are exposed to unauthenticated file deletion. Sites without Gridbox, or with it at 2.20.5.0 or later, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gridbox","joomla","medium","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107130","severity":null,"published_at":"2026-11-05T18:17:00+00:00","modified_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}