Gridbox 2.20.4.0: Two Security Vulnerabilities Fixed

On 8 October 2026, Balbooa released Gridbox 2.20.4.0. The new version fixes two security vulnerabilities: cross-site request forgery during language package installation and insufficient path validation in the image preview feature.

The vulnerabilities have been assigned the identifiers CVE-2026-102784 and CVE-2026-102783. The more dangerous of the two received a score of 8.7 under CVSS 4.0, corresponding to a High severity rating.

The developers recommend that all Gridbox users install version 2.20.4.0. This update is particularly important because it continues a series of security fixes released for the component since July 2026.

What Was Fixed?

Gridbox 2.20.4.0 fixes two different security issues. The first could lead to the installation of a software package selected by an attacker if a logged-in Super User opened a specially crafted link. The second allowed an unauthenticated visitor to access certain images located outside the configured media directory.

CSRF During Language Package Installation — CVE-2026-102784

Gridbox allows administrators to install additional interface languages directly from the component. This operation uses Joomla's package installation mechanism and must therefore be protected by user permission checks and a token associated with the current session.

In vulnerable versions, the language installation action could be triggered by a GET request without a valid CSRF token check. The attacker did not need an administrator account of their own. It was enough to convince an already authenticated Super User to open a specially crafted link or visit a malicious page.

If the attack succeeded, Gridbox could install a package selected by the attacker. Because a Joomla extension may contain executable PHP code, the possible consequences included:

• Execution of malicious code on the server.
• Reading and modification of website data.
• Creation of hidden administrator accounts.
• Installation of backdoors and other malicious files.
• Complete loss of control over the website.

The vulnerability received a score of 8.7 under CVSS 4.0 — High severity. It is not a completely unauthenticated attack in the usual sense: exploitation requires an action by a Super User with an active session. However, the attacker does not need to log in to the Joomla administrator area.

In version 2.20.4.0, the developers strengthened request validation so that the language installation operation cannot be executed without a valid security token.

Image Preview Path Validation Bypass — CVE-2026-102783

The second vulnerability affects the image preview feature. Gridbox is supposed to retrieve files only from the media directory configured in the component, but the previous path validation was not strict enough.

Under certain directory configurations, an attacker could request an image from a neighbouring folder whose name began with the same characters as the permitted directory. For example, if /images was allowed, the validation could incorrectly accept a path to a directory such as /images-backup.

No authentication or administrator interaction was required to exploit this issue. However, its capabilities were limited:

• The attacker could only read image file types supported by Gridbox.
• The vulnerability did not allow files to be modified or deleted.
• Exploitation was possible only when the server had a suitable directory structure and folder names.

The vulnerability received a score of 6.3 under CVSS 4.0 — Medium severity. In Gridbox 2.20.4.0, the validation was changed so that the image preview can serve files only from the exact permitted media directory.

Who Is at Risk?

All websites running Gridbox 2.20.3.1 or earlier are vulnerable. Both CVE records state that the fixes are available only in version 2.20.4.0.

The risk is especially relevant if:

• Website administrators open links from emails, user enquiries or support requests while remaining logged in to the Joomla administrator area.
• The server contains backup or service directories with image files whose names begin in the same way as the main media directory.
• Gridbox has not been updated for some time and a version earlier than 2.20.3.1 is installed.
• Several users have Super User privileges on the website.

Why Previous Updates Are Not Enough

Several important Gridbox security updates were released during 2026:

• 2.20.1 fixed a critical authentication bypass that could allow an attacker to obtain Super User privileges.
• 2.20.2 fixed a large group of vulnerabilities, including remote code execution, SQL injection, privilege escalation and file disclosure.
• 2.20.2.3 introduced additional hardening for authorisation, request handling, path validation and password recovery.
• 2.20.3.1 fixed an unauthenticated blind SQL injection vulnerability in the blog author parameter.
• 2.20.4.0 fixed CSRF during language installation and insufficient image path validation.

Installing one of the intermediate versions is therefore not enough. The safest option is to update directly to Gridbox 2.20.4.0 or a later version.

How to Fix the Problem: Step-by-Step Guide

Follow these steps to protect your website.

Step 1: Create a Backup

Before updating, create a complete backup of the website files and database. Store it outside the website directories and make sure that the backup can be restored.

Step 2: Update Gridbox to Version 2.20.4.0

1. In the Joomla administrator area, go to System → Update → Extensions.
2. Click Check for Updates.
3. Find Gridbox in the list.
4. Install version 2.20.4.0 or later.
5. After installation, clear the Joomla and Gridbox caches, as well as any server-side caching systems.
6. Check the installed version number and test the main pages and functions of the website.

Step 3: Check the Website for Signs of Compromise

Installing the update closes the vulnerabilities, but it does not remove changes that may have been made earlier. Websites that were running a Gridbox version earlier than 2.20.3.1 should be inspected particularly carefully.

1. Check user accounts: look for unknown Administrator or Super User accounts, paying particular attention to recently created users.
2. Check installed extensions: make sure that no unknown components, modules, plugins, templates or language packages have appeared in Joomla.
3. Check website files: look for recently created or modified PHP files, especially in /images, /media, /tmp, /cache and Gridbox directories.
4. Check scheduled tasks and settings: make sure that email settings, redirects, custom JavaScript, PHP code and template settings have not been changed.
5. Review server logs: look for suspicious requests to com_gridbox, unusual package installations, access to images outside the media directory and unexpected logins to the administrator area.
6. Check backup directories: do not store confidential images in folders such as /images-backup or other publicly accessible directories inside the website root.

Step 4: Apply Additional Security Measures

• Update Joomla and all installed extensions to their latest secure versions.
• Enable multi-factor authentication for every account with administrative privileges.
• Do not open suspicious links while you have an active Joomla administrator session.
• Limit the number of Super Users and grant each user only the permissions they actually need.
• Protect the administrator area with an additional password, IP restrictions or a web application firewall.
• Store backups outside the website root so that they cannot be downloaded directly from the internet.
• Create backups regularly and periodically test that they can be restored.

What Else Changed in Gridbox 2.20.4.0?

In addition to the security fixes, version 2.20.4.0 includes several functional changes:

• The image compression setting has been moved to Performance Tools → Images and now applies to images uploaded through different areas of Gridbox.
• Google and Facebook social login has been restored.
• Compatibility issues with JCE 3.0 have been fixed.
• Saving of responsive CSS settings has been fixed.
• Thumbnail display in the Media Manager widget has been fixed.
• Password requirement enforcement during registration has been improved.
• A 500 error during checkout after a fresh Gridbox installation has been fixed.
• Handling of server tokens containing a newline character has been fixed.

We can do everything for you

If everything listed above seems too complicated, if you simply do not want to spend your time on it or if you would like to save money on expensive extensions, we are ready to help:

• update your website to the latest Joomla version together with all extensions used on it;
• audit the installed extensions and then remove those that are not being used;
• configure website backups, including backups to remote storage;
• install licensed versions of popular extensions on your website;
• protect your website from hacking by implementing additional security measures;
• take your website under our wing by regularly updating the CMS and all extensions, including commercial ones.

Submit a request List of services