CVE-2026-65886 is a critical vulnerability in the balbooa.com Gridbox extension for Joomla, affecting versions 1.0.0 up to and including 2.20.1. The flaw is an improper limitation of a pathname to a restricted directory (CWE-22) in the photo viewer functionality, which allows unauthenticated attackers to read arbitrary files on the server. This can lead to exposure of sensitive information. The vulnerability has a CVSS 4.0 base score of 9.2, indicating high impact with network attack vector, no privileges or user interaction required, and high confidentiality and security scope impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the vulnerable Gridbox extension, potentially exposing sensitive information. The vulnerability impacts confidentiality and security controls with high severity. There is no indication of privilege escalation or integrity impact in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor balbooa.com and Joomla advisories for updates. Until a patch is available, consider restricting access to the photo viewer component or applying web application firewall rules to block suspicious requests targeting file read attempts.