EUVD-2026-46058
GHSA-pcwx-c962-fh8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable builder function with low complexity but requiring a high-privilege content role (PR:H); RCE breaks out of the app into the OS/web-server context (S:C) with full C/I/A impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default).
AnalysisAI
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder user (holding core.create or core.edit permissions) embed raw PHP tags in element content that are subsequently executed when the server's view-cache layer include()s the cached template. Exploitation requires caching to be enabled, which is the default, and yields full remote code execution on the underlying web server. No public exploit identified at time of analysis, though the reporter is Joomla itself and the CVSS 4.0 base score is 8.9 (High).
Technical ContextAI
Quix Page Builder Pro is a commercial drag-and-drop page builder distributed as a Joomla extension (CPE cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla). The root cause is CWE-94 (Improper Control of Generation of Code, i.e. code injection): user-supplied element content is written into a server-side view cache and later loaded with PHP's include() construct. Because include() compiles and executes anything between PHP tags in the included file, any <?php ... ?> sequence stored in an element becomes live server-side code at render time. The vulnerability lives in the caching pipeline rather than the initial input handler, so the injected code only detonates once the cache is populated and re-read - which is why the 'caching on (default)' precondition is architecturally essential rather than incidental.
RemediationAI
No vendor-released patch version was identified at time of analysis, so an exact upgrade target cannot be cited from the input data - monitor ThemeXpert at https://www.themexpert.com/quix-pagebuilder and update to the fixed Quix Page Builder Pro release as soon as it is published. As compensating controls until a patch is applied, tighten Joomla ACLs so that only fully trusted administrators retain core.create/core.edit on Quix content (removing these permissions from lower-trust author/editor accounts directly eliminates the required privilege), and audit existing Quix elements for embedded PHP tags. Because the code executes only through the view cache, disabling Quix/Joomla view caching removes the execution path, with the trade-off of measurable performance degradation and higher server load on content-heavy pages. Additionally, restrict or monitor filesystem write access to the view-cache directory and consider a WAF or content rule that rejects '<?php' and '<?=' sequences submitted through the builder. Rotate credentials and review logs for any accounts that could already have planted a payload.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today