CVE-2026-65431
A critical flaw (CVE-2026-65431) in the Joomla GeoIP extension from regularlabs.com lets attackers extract files from update archives without proper path validation, potentially overwriting arbitrary files on the server. This can lead to full compromise of the affected website. The vulnerability carries a CVSS score of 9.8.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Any Joomla site using the GeoIP extension from regularlabs.com, regardless of version.
Real-world impact
An attacker could overwrite critical files such as web application code, configuration files, or system files, giving them full control over the site and its data.
Why this severity
The CVSS score is high because the flaw is network‑reachable, requires no authentication, and allows an attacker to fully compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- ›Disable or uninstall the GeoIP extension until a vendor patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.