CVE-2026-102783: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in balbooa.com Gridbox extension for Joomla

The Gridbox extension for Joomla contains a path traversal vulnerability (CWE-22) in its image preview feature prior to version 2.20.4.0. The vulnerability is due to prefix-only containment logic in the UploaderHelper used by the showImage action, which resolves a request-controlled path and returns the image. If image decoding fails, the file is streamed directly. This logic allows an attacker to access files in sibling directories with the same prefix as the images directory, bypassing intended directory restrictions. The vulnerability is limited by restricting file extensions to Gridbox image types, reducing the risk of arbitrary file disclosure. The default media root is 'images', and no sibling directory with the same prefix was found in the tested environment. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.3. No official patch or remediation details are provided.

An attacker can exploit this vulnerability to read files outside the intended images directory by leveraging path traversal through sibling directories with the same prefix. However, the impact is limited because only files with Gridbox image extensions can be accessed, reducing the risk of arbitrary file disclosure. There is no indication of remote code execution or privilege escalation. The vulnerability is rated medium severity with a CVSS score of 6.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor balbooa.com and Joomla advisories for updates. Until a fix is available, restricting access to the affected directories and limiting exposure of the Gridbox image preview functionality may reduce risk.