---
id: CVE-2026-102783
title: >-
  Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox <
  2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site
  UploaderHelper 
summary: >-
  Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox <
  2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site
  UploaderHelper . The showImage action resolves a request-controlled path,
  calls tha…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: balbooa.com
product: com_gridbox
affected:
  - com_gridbox 1.0.0-2.20.3.1
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:07:57.460'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102783'
references:
  - url: 'https://www.balbooa.com/gridbox'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T14:10:49.755034Z'
cvssSource: cna
ingestedAt: '2026-10-08T13:42:55.135Z'
---

## Overview

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.