CVE-2026-65889 Details

A vulnerability in the Balbooa Gridbox Joomla extension, affecting versions prior to 2.20.2, allows for unauthenticated recursive directory deletion. The issue arises in the 'generateNewApp' method, where it improperly handles directory deletion requests, enabling actors to delete directories and their contents recursively.

Users of the Balbooa Gridbox Joomla extension should update to version 2.20.2, available through the Joomla Extensions updater or from the Balbooa account. After updating, it is recommended to check for any signs of compromise, such as unauthorized administrator accounts or hacked files.