CVE-2026-102783

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure.

• CWE-22

• https://www.balbooa.com/gridbox

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102778Joomla Extension - svenbluege.de - Cross-site scripting and …6.1
• CVE-2026-102779Joomla Extension - joomlafry.com - Unauthenticated forced ex…7.3
• CVE-2026-10278A vulnerability was determined in ishayoyo excel-mcp up to 1…6.3
• CVE-2026-102780Joomla Extension - joomlafry.com - Unauthenticated cross-rec…9.8
• CVE-2026-102781Joomla Extension - ordasoft.com - Unauthenticated Destructiv…6.9
• CVE-2026-102782Joomla Extension - ordasoft.com - Unauthenticated SQL inject…9.3
• CVE-2026-102784Joomla Extension - balbooa.com - CSRF in language installati…8.7
• CVE-2026-10279A vulnerability was identified in hiraishikentaro wezterm-mc…6.3
• CVE-2026-102792A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. …9.1
• CVE-2026-102793A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vu…9.1
• CVE-2026-102794A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0…9.1
• CVE-2026-102795Improper Access Control vulnerability in Apache Traffic Serv…9.3