CVE-2026-65431 is a critical vulnerability in the regularlabs.com GeoIP extension for Joomla. It involves improper limitation of a pathname to a restricted directory (CWE-22), specifically a Zip Slip vulnerability. The Geo IP database update archives are extracted broadly without validating the file paths, which can lead to arbitrary file writes outside the intended directory. This flaw affects all versions from 1.0.0 through 6.3.8. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high exploitability and severe impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation can allow an attacker to write arbitrary files to the server filesystem, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid applying Geo IP database updates from untrusted sources and consider disabling the GeoIP extension if feasible.