---
id: "CVE-2026-107130"
kind: "vulnerability"
aliases: ["CVE-2026-107130"]
title: "Joomla Gridbox extension lets anonymous users delete submission files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gridbox", "joomla", "other", "self-hosted"]
not_affected_if: ["gridbox-2.20.5.0-or-later", "no-file-upload-fields"]
published_at: "2026-11-05T18:17:00+00:00"
first_seen_at: "2026-11-05T18:40:09+00:00"
updated_at: "2026-11-05T18:40:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107130", "first_seen_at": "2026-11-05T18:40:09+00:00"}]
exploit_sources: []
---

# Joomla Gridbox extension lets anonymous users delete submission files

The Gridbox extension for Joomla, made by balbooa.com, versions before 2.20.5.0, lets an unauthenticated visitor delete files uploaded through form submissions and fields. An attacker gets data loss of uploaded files without needing an account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gridbox version in the Joomla administrator under Extensions > Manage.
- Confirm whether any Gridbox forms or fields accept file uploads on the site.

## Fix

- Gridbox versions below `2.20.5.0` are affected; move to `2.20.5.0` or later.

## Timeline

- 2026-11-05T18:40:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107130

## From the sources

Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_