CVE-2026-107129

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
balbooa.comGridbox extension for Joomla1.0.0-2.20.4.2

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071306.9Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0CVE-2026-107148.8A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta WeCVE-2026-1071456.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limitingCVE-2026-1071466.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of serCVE-2026-1071476.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lCVE-2026-107155.1Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticCVE-2026-1071515.9Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbCVE-2026-1071527.1An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any clieCVE-2026-1071537.0Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physiCVE-2026-1071548.8A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially eCVE-2026-1071558.8A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could pCVE-2026-1071572.0Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application an
CVE-2026-107129: Medium severity, CVSS 5.5 | Vulnix