Read the docs
TI-2026-69486 Aliases CVE-2026-102783GHSA-89x5-vmf9-w5cx

Path traversal in Joomla Gridbox extension image preview

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The Gridbox extension for Joomla from balbooa.com, before 2.20.4.0, has a path traversal flaw (CWE-22). Its containment check only compares path prefixes, so a sibling directory such as images-backup can pass the check even though it lies outside the images root. An unauthenticated remote attacker can read image files outside that root, although the route limits file extensions to Gridbox image types.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00473 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BalbooaGridbox extension for Joomla1.0.0-2.20.3.1—No fix listedCNA
  • Gridbox extension for Joomla VendorBalbooa Affected 1.0.0-2.20.3.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:balbooa:gridbox:*:*:*:*:*:*:*:*——Balbooa
  • cpe:2.3:a:balbooa:gridbox:*:*:*:*:*:*:*:* Versions — — ·Balbooa

Remediation

The sources list no fixed version for Gridbox extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-102783
  2. 2026-10-08 Alias added: GHSA-89x5-vmf9-w5cx

References

Other 1

  • TI-2026-40656 Unrestricted file upload in balbooa.com Balbooa Forms extension for Joomla KEVCVSS 4.0CRITICAL 10.0
  • TI-2021-22543 Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated CVSS 4.0HIGH 8.8
  • TI-2018-08357 The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is… CVSS 3.0MEDIUM 6.1
  • TI-2026-65394 Code injection in Balbooa Forms extension for Joomla CVSS 4.0CRITICAL 9.5
  • TI-2026-46921 Code injection in Balbooa Forms component for Joomla CVSS 4.0CRITICAL 10.0
  • TI-2026-47660 Code injection in Balbooa Forms extension for Joomla CVSS 4.0CRITICAL 10.0
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences