Gridbox for Joomla: unauthenticated SQL injection (CVE-2026-102788)
A vulnerability, CVE-2026-102788 (CVSS 9.3), was published in the Gridbox extension (balbooa.com) for Joomla. On store product list pages, the sort-by URL parameter is passed to GridboxHelper::getBlogPosts() and inserted into ORDER BY without an allowlist check.
Checked in Shield: no
Who is affected
Joomla sites running Gridbox versions below 2.20.4.2. No authentication is required to exploit it.
How to check
In the Joomla admin panel open Extensions → Manage and find Gridbox. If the version is below 2.20.4.2, the site is vulnerable.
How to fix
A fix is available: update Gridbox to version 2.20.4.2 or later.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD (CVE-2026-102788).
