The Quix Page Builder Pro extension for Joomla is vulnerable to an unauthenticated path traversal through form elements on published pages. This flaw requires that a page with a Form element is published to the front end, allowing unauthenticated frontend users to construct arbitrary file paths and read any file accessible to the web server, exposing potentially sensitive data. This weakness is classified as CWE-22, reflecting improper validation of file path inputs.

All installations of Quix Page Builder Pro from themexpert.com that are running versions prior to 6.2.1 are impacted. The vulnerability is triggered only when a page with a Form element has been published to the front end; it does not require any authenticated session.

With a CVSS score of 8.7, the flaw offers moderate‑to‑high severity. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, and the issue is not listed in CISA KEV, so exploitation probability is quantifiable but low. The likely attack path involves an unauthenticated user visiting the vulnerable form, manipulating the form field values to include traversal sequences, and requesting any file on the server. Successful exploitation results in reading arbitrary files, potentially compromising confidentiality and the integrity of the site’s content and configuration.