CVE-2026-60027 is a path traversal vulnerability in the themexpert.com Quix Page Builder Pro Joomla extension prior to version 6.2.1. It permits unauthenticated users to exploit form elements on published pages to traverse directories and read arbitrary files on the server. This vulnerability arises from improper limitation of pathname to a restricted directory (CWE-22). No official remediation or patch has been confirmed as of the published date.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information. This can lead to information disclosure and further compromise depending on the contents of accessible files. The vulnerability does not require authentication or user interaction beyond accessing a page with a Form element.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to pages containing Form elements and monitor for suspicious activity. Consider disabling or removing the Quix Page Builder Pro extension if feasible.