Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Joomla Quix Page Builder Allows Frontend Users to Read Files

CVE-2026-60027 · published 3 months ago
Summary

The Quix Page Builder Pro extension for Joomla allows unauthenticated users to access and read files on the server. This is a security risk because it could allow attackers to steal sensitive information. To fix this, update the Quix Page Builder Pro extension to version 6.2.1 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
themexpert.com quix page builder pro extension for joomla 1.0-6.2.0
Original advisory text
Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1
Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
CVE-2026-60027 · NVD
CVE-2026-60027 · MITRE
Track software like this
Free during beta