A critical path traversal vulnerability in the Regular Labs GeoIP extension for Joomla could allow an unauthenticated attacker to overwrite arbitrary files on the host filesystem.

This is a path traversal vulnerability (CWE-22), commonly known as Zip Slip, where the extension fails to validate paths within Geo IP database update archives. The vulnerability is exploitable by unauthenticated remote attackers.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation enables unauthorized file system access, which may lead to remote code execution, system compromise, or complete service disruption. The ability to overwrite arbitrary files poses a significant risk to the integrity and availability of the Joomla installation and the underlying server.

Immediate Action: Update the Regular Labs GeoIP extension for Joomla to the latest available version released after July 22, 2026.

Proactive Monitoring: Review web server and application logs for suspicious file extraction patterns or requests directed at unexpected directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the potential for full system compromise, administrators should prioritize updating the GeoIP extension immediately. Ensure that the integrity of the Joomla installation is verified following any updates to confirm no malicious files were introduced prior to remediation.