CVE-2026-65885 is an authenticated arbitrary file upload vulnerability in the balbooa.com Gridbox extension for Joomla versions 1.0.0 through 2.20.1. The file upload methods do not properly restrict file types, allowing authenticated attackers to upload arbitrary files. This vulnerability can escalate to authenticated remote code execution if combined with CVE-2026-65884, which allows attacker account creation. The vulnerability is identified as CWE-434 and has a CVSS 4.0 score of 9.4, indicating critical impact with high attack vector and complexity.

Authenticated attackers can upload arbitrary files, potentially leading to remote code execution when combined with a related vulnerability (CVE-2026-65884). This can compromise the affected Joomla sites running the vulnerable Gridbox extension versions, allowing attackers to execute code on the server with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links have been provided at this time. Until a patch is available, restrict access to the Gridbox extension to trusted users only and monitor for suspicious activity related to file uploads. Review Joomla and balbooa.com advisories regularly for updates.