The Gridbox extension for Joomla by balbooa.com contains an improper access control vulnerability (CWE-284) combined with directory traversal issues (CWE-22) in the generateNewApp method. This flaw permits unauthenticated users to recursively delete directories on the affected system. The vulnerability affects all versions from 1.0.0 through 2.20.1 inclusive. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on availability. No vendor advisory or patch is currently documented.

Successful exploitation allows unauthenticated attackers to delete directories recursively, potentially causing significant data loss and service disruption. The high CVSS score reflects the critical nature of this availability impact without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Joomla installation and monitor for suspicious activity related to directory deletion attempts. Avoid exposing the Gridbox extension to untrusted networks.