# CVE-2026-60027: ThemeXpert Quix Page Builder Pro path traversal in form elements

Source: https://junglewise.ai/threats/cve-2026-60027-themexpert-quix-page-builder-pro-path-traversal-in-form-elements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-60027 · Severity: info · CVSS 8.7 · Published 2026-07-20

Quix Page Builder Pro, a popular drag-and-drop design tool for Joomla websites, contains a security flaw in its form elements. An unauthorized person can exploit this to access and read sensitive files on the web server that should normally be restricted. This could lead to the exposure of configuration files, system data, or other private information, potentially compromising the entire website's security.

Technologies: [ThemeXpert Quix Page Builder Pro](https://junglewise.ai/threats/technologies/quix-page-builder-pro). Vendors: [ThemeXpert](https://junglewise.ai/threats/vendors/themexpert).

## Quick answers

**Is CVE-2026-60027 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60027 being exploited in the wild.

**How severe is CVE-2026-60027?** Informational severity, with a CVSS score of 8.7, published 20 July 2026.

**Which products and versions are affected?** ThemeXpert Quix Page Builder Pro 1.0-6.2.0.

**Is there a fix for CVE-2026-60027?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60027 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-60027?** Check whether you run ThemeXpert Quix Page Builder Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Quix Page Builder Pro extension for Joomla (versions 1.0 through 6.2.0). The flaw is located within the handling of form elements on published pages. An unauthenticated remote attacker can use specially crafted requests to bypass directory restrictions and read arbitrary files from the underlying filesystem. The attack requires at least one published page containing a Form element to be accessible. The vulnerability has been assigned a CVSS 4.0 base score of 8.7, reflecting high confidentiality impact.

## Affected products

- ThemeXpert Quix Page Builder Pro extension for Joomla 1.0-6.2.0

## Timeline

- 2026-07-20: advisory: CVE published by Joomla! Project

## References

- [https://www.themexpert.com/quix-pagebuilder](https://www.themexpert.com/quix-pagebuilder)

## Related threats

- [ThemeXpert Quix Page Builder Pro information disclosure in AJAX handler](https://junglewise.ai/threats/cve-2026-60031-themexpert-quix-page-builder-pro-information-disclosure-in-ajax)
- [ThemeXpert Quix Page Builder Pro improper access control in media upload](https://junglewise.ai/threats/cve-2026-60030-themexpert-quix-page-builder-pro-improper-access-control-in-media)
- [ThemeXpert Quix Page Builder Pro PHP code injection in view-cache](https://junglewise.ai/threats/cve-2026-60026-themexpert-quix-page-builder-pro-php-code-injection-in-view-cache)