EUVD-2026-46056
GHSA-p9j6-qqww-29vg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description requires an authenticated account (PR:L, not PR:N); network-reachable low-complexity; impact is unauthorized file upload = limited integrity (I:L), no confidentiality or availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.
AnalysisAI
Improper access control in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets authenticated users upload media files even when they lack the media-management permission normally required for that action. The flaw is a permission-enforcement gap on the media upload function rather than a full unauthenticated compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 4.0 base score is 8.7 (High), though the supplied vector conflicts with the 'authenticated users' language in the description.
Technical ContextAI
Quix Page Builder Pro is a commercial drag-and-drop page-building extension for the Joomla CMS, developed by ThemeXpert (CPE cpe:2.3:a:themexpert.com:quix_page_builder_pro_extension_for_joomla). The weakness is classed as CWE-284 (Improper Access Control): the extension exposes a media/file upload capability but fails to verify that the authenticated Joomla user actually holds the media-management ACL permission before accepting the upload. In Joomla, media handling is normally gated by core ACL rules and per-component permissions; here the extension performs the upload without honoring those checks, so any logged-in account can write media files regardless of its assigned role.
RemediationAI
No vendor-released patch version was identified at time of analysis; the only reference (https://www.themexpert.com/quix-pagebuilder) is the product homepage, not a fix advisory. Administrators should check ThemeXpert directly for an updated Quix Page Builder Pro release and apply the latest version once a fix is published, and monitor the Joomla Vulnerable Extensions List for the patched version number. As compensating controls until a patch is confirmed: restrict which Joomla user groups can authenticate to the site backend/front-end editing to trusted accounts only, since exploitation requires a logged-in user; audit existing low-privilege accounts and disable self-registration or unnecessary editor roles to shrink the pool of authenticated attackers (trade-off: reduces collaborative content workflows); and monitor the media directory for unexpected file uploads and enforce server-side file-type/extension filtering at the web-server layer to limit what an improperly-authorized upload can place on disk (trade-off: added upload validation overhead). Do not treat these as a substitute for the eventual vendor patch.
Authenticated PHP code execution in ThemeXpert's Quix Page Builder Pro extension for Joomla lets a privileged builder us
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend use
SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary S
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated buil
Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remot
Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today