VulnSocial

CVE-2026-65885Disclosure(balbooa / gridbox)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch balbooa gridbox systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

balbooa CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gridbox

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
balbooa
Products
gridbox

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-29: 2Patch / Workaround · 2026-07-29: 1Technical Details · 2026-07-29: 107-29
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨Critical - Joomla Gridbox Authenticated Arbitrary File Upload (CVE-2026-65885) Balbooa Gridbox (Joomla component com_gridbox) allows authenticated users to upload arbitrary files via its upload handler without strict extension/path validation. Chained with CVE-2026-65884 to obtain an account, attackers can drop a PHP webshell and achieve authenticated RCE. 👉Affected: http://balbooa.com Gridbox for Joomla (com_gridbox) versions unknown

    Post summary

    A new authenticated arbitrary file upload flaw (CVE-2026-65885) in Balbooa Gridbox (Joomla) allows attackers to upload malicious files, chain with CVE-2026-65884 to gain an account, and deploy a PHP webshell for authenticated RCE.

    0000099
    274 followersView on X
  • PJ@Npj8448
    Patch

    "Ransomware attacks surge with groups like Insomnia, Black X, Section9, and Akira on the rise. Don't forget to patch vulnerabilities like CVE-2026-65885 and CVE-2026-65884 to stay safe! #ThreatIntel #CyberSecurity" https://pranithjain.qzz.io/threatintel/cyberpulse

    Post summary

    The post highlights ransomware activity and urges users to patch CVE-2026-65885 and CVE-2026-65884, emphasizing the importance of maintaining security updates.

    0000057
    51 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbalbooagridbox-joomla\!-

Explore more

Back to dashboardbalbooa CVEsgridbox vulnerabilities