CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-102788?
CVE-2026-102788 is a critical vulnerability in balbooa.com Gridbox extension for Joomla, published on 27 Oct 2026.
Official description
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Weakness: CWE-89
Which versions are affected by CVE-2026-102788?
How do I fix CVE-2026-102788?
No fix has been published for CVE-2026-102788 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102788 being exploited?
There is no known exploitation of CVE-2026-102788 in the wild and no public exploit code.
Sources
Also known as GHSA-hqjq-crc6-5fp3.