CVE-2026-64872 is a path traversal vulnerability in the Cache Cleaner Pro extension for Joomla by regularlabs.com. The issue allows attackers to specify custom purge and log paths that can escape the site's webroot directory, potentially leading to unauthorized file access or modification outside the intended directory scope. The vulnerability affects versions from 1.0.0 up to and including 9.7.6. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed. No vendor advisory or patch is currently available, and no known exploits have been reported.

An attacker can exploit this vulnerability to traverse directories outside the Joomla site webroot by manipulating custom purge and log paths. This could lead to unauthorized access or modification of files outside the intended directory, potentially exposing sensitive data or affecting site integrity. However, the impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Cache Cleaner Pro extension and monitor for suspicious activity related to path traversal attempts. Avoid exposing the extension to untrusted users or networks.