CVE-2026-102784: Joomla Gridbox Extension CSRF Vulnerability

CVE-2026-102784 Overview

CVE-2026-102784 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Balbooa Gridbox extension for Joomla in versions prior to 2.20.4.0. The flaw resides in the PagesController component, where the shared trait validates the Joomla session token only when the HTTP method is POST. The addLanguage action does not enforce POST, allowing attackers to invoke it through a GET request that bypasses token validation. An attacker who lures an authenticated administrator to a malicious page can trigger installation of attacker-controlled language packages.

Critical Impact
An attacker can force a privileged Joomla user to install an attacker-supplied ZIP from a remote URL, enabling full compromise of the site through arbitrary file placement under the victim's core.tools permission.

Affected Products

Balbooa Gridbox for Joomla, versions prior to 2.20.4.0
Joomla sites with privileged users holding the core.tools permission
Any Joomla installation where Gridbox PagesController is reachable

Discovery Timeline

2026-10-08 - CVE-2026-102784 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-102784

Vulnerability Analysis

The vulnerability is a textbook CSRF issue [CWE-352] in the Balbooa Gridbox PagesController. Gridbox relies on a shared trait to enforce Joomla's anti-CSRF session token. That trait only invokes the token check when the request method is POST. The addLanguage action does not restrict itself to POST and reads both the url and zip parameters through Joomla's generic request input API, which accepts values from either query string or form body.

Because of this, a crafted GET request to the addLanguage endpoint reaches the privileged code path without the trait ever validating a token. The action still enforces the Joomla core.tools ACL check, but that check only validates the identity of the currently authenticated user. It does not prove that the user intentionally initiated the request.

An attacker exploits this by hosting a page that triggers a cross-origin GET request, for example through an <img> tag or auto-submitting link. When an administrator with core.tools visits the page while logged in, the browser forwards their session cookie. Gridbox then downloads the attacker-controlled ZIP from the attacker-controlled URL and installs it as a language extension on the server.

Root Cause

The root cause is incomplete coverage of CSRF token validation. The trait conditionally enforces the token based on HTTP method rather than on sensitive action semantics. Any state-changing action reachable via GET therefore inherits no CSRF protection.

Attack Vector

Exploitation requires user interaction from an authenticated administrator but no attacker credentials. The attack vector is network-based and relies solely on the victim visiting a hostile page. Successful exploitation installs an arbitrary language package, which maps to writing attacker-controlled files onto the Joomla server and can escalate to code execution.

No verified public proof-of-concept code is published. See the Balbooa Gridbox Overview for product details.

Detection Methods for CVE-2026-102784

Indicators of Compromise

Unexpected language packages installed in Joomla's /language/ directory, especially those referencing remote download URLs not associated with legitimate Joomla sources.
Web server access logs containing GET requests to Gridbox PagesController endpoints invoking addLanguage with url or zip parameters.
Outbound HTTP requests from the Joomla server retrieving ZIP archives from unfamiliar domains shortly after an administrator browsing session.

Detection Strategies

Review web server logs for GET requests to Gridbox administrative routes that carry url= or zip= query parameters, which should normally only appear in POST bodies.
Monitor Joomla extension install events and alert on language installations originating outside planned maintenance windows.
Correlate administrator browser activity with server-side extension installation events to spot CSRF-driven actions.

Monitoring Recommendations

Enable Joomla action logs for the com_installer component and forward them to a centralized logging platform.
Baseline the set of installed Gridbox and Joomla language packages, and alert on deviations.
Track outbound egress from the web server, flagging ZIP downloads to non-allowlisted hosts.

How to Mitigate CVE-2026-102784

Immediate Actions Required

Upgrade Balbooa Gridbox to version 2.20.4.0 or later on all Joomla sites that use the extension.
Audit installed language packages and remove any that cannot be attributed to a legitimate administrator action.
Rotate Joomla administrator session tokens and review core.tools permission assignments to minimize the exposed user set.

Patch Information

Upgrade Balbooa Gridbox to version 2.20.4.0 or later, which enforces session token validation on the addLanguage action regardless of HTTP method. Refer to the Balbooa Gridbox product page for release availability.

Workarounds

Restrict access to the Joomla administrator interface by source IP or VPN until the patched version is deployed.
Require administrators to use isolated browser profiles for Joomla management to limit cross-site exposure.
Deploy a web application firewall rule that blocks GET requests to Gridbox PagesController routes carrying url or zip parameters.

bash

# Example WAF rule concept (ModSecurity) to block GET-based addLanguage invocations
SecRule REQUEST_METHOD "@streq GET" \
  "chain,id:1026102784,phase:1,deny,status:403,msg:'Block Gridbox CSRF addLanguage via GET'"
  SecRule REQUEST_URI "@rx (?i)option=com_gridbox.*task=.*addLanguage" \
    "chain"
    SecRule ARGS_NAMES "@rx ^(url|zip)$" "t:none"