CVE-2026-65754 is a directory traversal vulnerability in the ReReplacer Pro extension for Joomla by regularlabs.com. The vulnerability arises from insecure path handling in the XML include functionality, which allows an attacker to read files outside the web root directory. This improper limitation of pathname access (CWE-22) can lead to unauthorized information disclosure. The vulnerability affects versions 1.0.0 through 15.0.3. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files outside the intended directory, potentially exposing sensitive configuration files or other data. The CVSS score of 7.5 indicates a high impact on confidentiality. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected extension or disabling XML include functionality if feasible. Monitor official channels from regularlabs.com for updates or patches addressing this vulnerability.