The Gridbox extension for Joomla by balbooa.com contains a directory traversal vulnerability (CWE-22) in versions 1.0.0 up to 2.20.1. This flaw allows unauthenticated attackers to leverage the photo viewer functionality to read arbitrary files on the server. The vulnerability is publicly disclosed with a CVSS 4.0 score of 9.2, reflecting critical severity due to its ease of exploitation and potential impact on confidentiality. No vendor advisory or patch information is currently provided, and the vulnerability is not related to any cloud service.

Successful exploitation enables unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information. This compromises confidentiality and could lead to further attacks depending on the data accessed. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the photo viewer component or applying web application firewall rules to block suspicious requests targeting this functionality.