Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Description

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

Affected Products

Vendor	Product	Versions
balbooa.com	gridbox extension for joomla	1.0.0-2.20.1

References

https://www.balbooa.com/gridbox(product)
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/(third-party-advisory)

Related News (1 articles)

Tier C

VulDB5h ago

CVE-2026-65889 | balbooa Gridbox Extension up to 2.20.1 generateNewApp path traversal

→ No new info (linked only)

CISA KEV❌ No

Actively exploited❌ No

CWECWE-284, CWE-22

PublishedJul 29, 2026

Trending Score30

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

NONECVE-2026-65884EXPKEV

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

Trending: 101

NONECVE-2026-65885EXPKEV

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Trending: 92

NONECVE-2026-65880

Joomla Extension - joomshaper.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

Trending: 31

NONECVE-2026-65886

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Trending: 30

NONECVE-2026-65890

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Trending: 30

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 29, 2026

Discovered by ZDM

Jul 29, 2026