CVE-2026-65431 describes a vulnerability in the GeoIP extension for Joomla where the update archives for the Geo IP database are extracted without validating the file paths. This improper limitation of a pathname to a restricted directory (CWE-22) can allow an attacker to write files to arbitrary locations on the server, potentially leading to code execution or other impacts depending on the server configuration. The affected versions are from 1.0.0 up to and including 6.3.8. There is no CVSS score or vendor advisory indicating a patch or mitigation at this time.

The vulnerability allows unsafe extraction of files from update archives, which can lead to arbitrary file writes outside the intended directory. This can compromise the integrity of the server hosting the Joomla extension and may enable further attacks depending on the environment. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting update archive sources, applying file system permissions to limit write access, or disabling automatic updates if feasible.