CVE-2026-60027CWE-22path-traversal

CVE-2026-60027

published July 20, 2026

CVSS
8.7
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-20T23:17Z
References (1)
https://www.themexpert.com/quix-pagebuilder · [email protected]
EPSS history
Timeline
  • 20 JUL 18:14Z
    Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1
    cvelistv5