Which versions of Quix Page Builder are affected by CVE-2026-60027?

The Quix Page Builder Pro extension for Joomla contains a path traversal vulnerability (CVE-2026-60027, CVSS 8.7) allowing unauthenticated attackers to read arbitrary files from web servers.

How to fix or mitigate CVE-2026-60027?

Within 24 hours, inventory all Joomla installations to identify instances of Quix Page Builder Pro and document installed versions; immediately disable the extension to prevent exploitation. Within 7 days, contact ThemeXpert for patch availability timeline and interim guidance; evaluate replacement page builder extensions from vendors with active security practices. Within 30 days, deploy the vendor-released security patch once available, re-enable Quix Page Builder Pro, and conduct a security audit of affected installations to confirm no unauthorized file access occurred during the vulnerability exposure window.

Quix Page Builder CVE-2026-60027

Q: What is the CVSS score of CVE-2026-60027?

CVE-2026-60027 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46063 HIGH

Path Traversal (CWE-22)

2026-07-20 Joomla

GHSA-2jwh-h49v-x83h

Path Traversal Quix Page Builder Pro Extension For Joomla Themexpert Com

8.7

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network read of arbitrary files (PR:N/UI:N/AC:L) yields high confidentiality only; no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:22 vuln.today

CVE Published

Jul 20, 2026 - 18:14 cve.org

HIGH 8.7

DescriptionCVE.org

The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.

AnalysisAI

Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend users to read files outside the intended directory by supplying traversal sequences to a Form element on a published page. The flaw (CWE-22) carries a CVSS 4.0 base score of 8.7 driven by high confidentiality impact with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes it a strong candidate for opportunistic scanning.

Technical ContextAI

Quix Page Builder Pro is a commercial drag-and-drop page builder extension for the Joomla CMS, used to compose front-end pages from reusable elements including a Form element that processes user-supplied input. The vulnerability is a classic CWE-22 path traversal: user-controlled input reaching the form-handling code is used to construct a filesystem path without adequate canonicalization or allowlist validation, so sequences such as ../ let a request escape the web root and reference arbitrary files readable by the web server process. The single CPE, cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla:*, confirms the affected component is the Pro edition of the extension rather than Joomla core; the wildcard version means no fixed lower/upper bound was published in the CPE.

RemediationAI

No vendor-released patch identified at time of analysis - the only supplied reference (https://www.themexpert.com/quix-pagebuilder) is a product page, not an advisory with a fix version, so administrators should contact ThemeXpert or check the extension's update channel for a patched release and upgrade to it as soon as one is published. As an immediate compensating control, unpublish or remove any front-end page containing a Quix Form element, since the description states a published page with a Form element is required to reach the vulnerable code - this eliminates the attack surface at the cost of losing form functionality on those pages. Additionally, deploy a WAF or Joomla security plugin rule to block traversal patterns (../, encoded %2e%2e%2f, and null-byte variants) on the Quix form-handling endpoint, and restrict the web server's filesystem permissions so the Joomla process cannot read sensitive OS files (e.g. /etc/passwd, configuration.php); note WAF rules can be bypassed with alternate encodings and are a stopgap, not a substitute for the vendor fix.