CVE-2026-60027: CWE-22 Improper Limitation of a Pathname to a Restricted Directory in themexpert.com Quix Page Builder Pro extension for Joomla
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
AI Analysis
Technical Summary
CVE-2026-60027 is a path traversal vulnerability (CWE-22) in the themexpert.com Quix Page Builder Pro extension for Joomla. The vulnerability permits unauthenticated users to exploit form elements on published pages to perform directory traversal attacks, enabling them to read arbitrary files on the server. This issue affects versions from 1.0 up to and including 6.2.0. No official patch or remediation guidance has been published as of the data provided.
Potential Impact
An attacker can read arbitrary files on the server without authentication by exploiting the path traversal vulnerability via form elements on published pages. This can lead to disclosure of sensitive information stored on the server, potentially compromising confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to published pages with Form elements or disable the Quix Page Builder Pro extension if possible to reduce exposure.
CVE-2026-60027: CWE-22 Improper Limitation of a Pathname to a Restricted Directory in themexpert.com Quix Page Builder Pro extension for Joomla
Description
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
CVSS v4.0
Score 8.7high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-60027 is a path traversal vulnerability (CWE-22) in the themexpert.com Quix Page Builder Pro extension for Joomla. The vulnerability permits unauthenticated users to exploit form elements on published pages to perform directory traversal attacks, enabling them to read arbitrary files on the server. This issue affects versions from 1.0 up to and including 6.2.0. No official patch or remediation guidance has been published as of the data provided.
Potential Impact
An attacker can read arbitrary files on the server without authentication by exploiting the path traversal vulnerability via form elements on published pages. This can lead to disclosure of sensitive information stored on the server, potentially compromising confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to published pages with Form elements or disable the Quix Page Builder Pro extension if possible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-07-08T05:31:35.889Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e6c122a4a8d59898880b1
Added to database: 07/20/2026, 18:42:26 UTC
Last enriched: 07/20/2026, 18:57:10 UTC
Last updated: 07/21/2026, 05:03:50 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.