Security
Gridbox 2.20.5.0 fixes four Joomla security flaws
Balbooa’s Gridbox 2.20.5.0 fixes four security vulnerabilities in the Joomla page-builder extension, including an unauthenticated file-deletion flaw rated High.
Research published by mySites.guru says versions 2.20.4.2 and earlier are affected. The most serious issue is a path-traversal flaw that could let an unauthenticated visitor delete files. A second unauthenticated deletion issue affects form-submission attachments, while two stored cross-site scripting (XSS) flaws affect comments, reviews and replies.
The release has an overall High severity rating. The four issues have been assigned the following CVE identifiers: CVE-2026-105607, CVE-2026-107129, CVE-2026-107130 and CVE-2026-107903. The source says the CVE records had been reserved but were not yet published, and does not map individual identifiers to specific flaws.
There is no public report of exploitation, and none of the identifiers was listed in CISA’s Known Exploited Vulnerabilities catalogue at publication.
- Update every affected Gridbox installation to
2.20.5.0through Joomla’s update tools. - After updating, verify the installed version and check previously affected sites for suspicious file changes or administrator accounts.
Approximately 92% of Gridbox sites monitored by mySites.guru were on affected versions.
Originally reported by mySites.guru.