EUVD-2026-47917
GHSA-x4cq-64pm-5635
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
4DescriptionCVE.org
Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
AnalysisAI
Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time.
More in Geoip Extension For Joomla
View allUnauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 thro
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in
GeoIP rule bypass in Joomla Geo
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today