CVE-2026-65712 describes an improper limitation of a pathname to a restricted directory in the CDN for Joomla Pro extension by regularlabs.com. The insecure path handling in the CDN versioning functionality permits checking file paths outside the site directory, which can expose local file existence and modification metadata. This vulnerability affects versions 1.0.0 through 7.3.7 of the extension. The CVSS 3.1 score of 6.2 reflects a medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information available at this time.

An attacker with local access can exploit this vulnerability to determine the existence and modification metadata of files outside the intended site directory. This exposure of local file information can aid in further attacks or reconnaissance. There is no direct impact on file integrity or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity related to file path access. Avoid exposing the vulnerable extension in untrusted environments.