CVE-2026-107129: Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

Q: Which installations should be prioritized for remediation?

Installations using the Gridbox Joomla extension with a version earlier than 2.20.5.0 should be prioritized. The supplied data identifies path traversal leading to arbitrary file deletion as the affected condition.

Q: Is authentication required to exploit this issue?

The supplied data is inconsistent: the title describes the issue as unauthenticated, while the CVSS vector specifies high privileges required (PR:H). Validate the actual exploit prerequisites in your environment before using either assumption for exposure assessment.

Published Nov 5, 2026

Updated

Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

Event History

Nov 5, 2026

CVE Published

via MITRE·05:58 PM

Data Sourced

via MITRE·05:58 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be prioritized for remediation?

Installations using the Gridbox Joomla extension with a version earlier than 2.20.5.0 should be prioritized. The supplied data identifies path traversal leading to arbitrary file deletion as the affected condition.

Is authentication required to exploit this issue?

The supplied data is inconsistent: the title describes the issue as unauthenticated, while the CVSS vector specifies high privileges required (PR:H). Validate the actual exploit prerequisites in your environment before using either assumption for exposure assessment.

CVE-2026-107129: Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

Event History

Frequently Asked Questions

Which installations should be prioritized for remediation?

Is authentication required to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be prioritized for remediation?

Is authentication required to exploit this issue?