# Quix Page Builder (com_quix) below 6.2.2 - CVE-2026-58078 (CVSS 8.7) Unauthenticated SQL Injection (database read), Code Execution, Path Traversal and Stored XSS [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-60029 CVE-2026-60029MediumCVSS 5.1CVE published 20 July 2026Added to mySites.guru 15 July 2026 # Quix Page Builder (com\_quix) below 6.2.2 - CVE-2026-58078 (CVSS 8.7) Unauthenticated SQL Injection (database read), Code Execution, Path Traversal and Stored XSS Quix Page Builder before 6.2.1 contains an unauthenticated SQL injection in the joomla-article builder element. An article id taken directly from a request parameter is concatenated into a database query with no integer cast or escaping, and the AJAX handler reflects the database error back to the caller, so an anonymous attacker with no login and no CSRF token can read arbitrary data from the site database, including user password hashes and the Joomla secret. This is the error-based kind of injection, so the data returns in the response rather than having to be inferred a bit at a time. Discovered and reported to ThemeXpert by mySites.guru (Phil Taylor), and confirmed against the Quix Pro 6.2.0 release. It is tracked as CVE-2026-58078, assigned by the Joomla CNA (CVSS 4.0 8.7, High), crediting Phil Taylor of mySites.guru as the finder. Quix 6.2.1 fixes this by casting the id to an integer before it reaches the query. Quix 6.2.1 also fixes five further security issues reported by mySites.guru in the same disclosure: a code-execution path via the Raw HTML element (PHP tags in element content are now neutralised), a path traversal and arbitrary file read in the Form element submission handler, stored XSS through the icon field including inline SVG, a missing permission check on the admin media manager endpoint, and the reflection of internal error details in front-end AJAX responses. ThemeXpert shipped 6.2.1 on 15 July 2026, the same day the issues were reported, and also hardened the bundled JMedia media manager in 1.6.1 (blocking executable and polyglot uploads and remote-URL SSRF, sanitising uploaded SVG, and serving files with hardened headers). Fix: update Quix to 6.2.1 or later, and update JMedia to 1.6.1 or later if installed. One update closes all six issues. A web application firewall with SQL injection filtering enabled will block the injection payload, but that buys time and is not a fix. Also covered by this rule, all affecting Quix Page Builder Pro 1.0 to 6.2.0 and fixed in the same release: CVE-2026-60026 (authenticated PHP code execution via element content executed through the view-cache include, requires caching on, which is the default), CVE-2026-60027 (unauthenticated path traversal via form elements allowing arbitrary file read, requires a published page with a Form element), CVE-2026-60028 and CVE-2026-60029 (authenticated stored XSS via unescaped output, unsanitised SVG and id/class fields that render for public users), CVE-2026-60030 (authenticated users could upload media regardless of their media management permissions) and CVE-2026-60031 (information disclosure through raw exceptions reflected in AJAX handler responses). Copy citation ## Is my site affected? - **Affected** - Quix Page Builder from 1.0.0 up to but not including 6.2.2 - **Fixed in** - 6.2.2 - **What to do** - Update Quix Page Builder to 6.2.2 for this flaw, or to 6.3.4 or later, which no rule we check matches. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-60029 is scored The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 5.1 Medium CVSS 4.0, scored by Joomla CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:H Privileges required** - High. Needs an account with elevated rights - **UI:N User interaction** - None. Nobody has to be tricked into anything ### What it does to the site - **VC:L Confidentiality** - Low. Some data can be read - **VI:L Integrity** - Low. Some data can be altered - **VA:L Availability** - Low. The site slows or stutters ### What it does beyond the site - **SC:N Confidentiality** - None. Other systems keep their data - **SI:N Integrity** - None. Other systems keep their integrity - **SA:N Availability** - None. Other systems stay up The rule below is rated High for the set of 7 CVEs it covers together, not for this record on its own. ## Timeline 1. 15 July 2026mySites.guru check added for Quix Page Builder (from 1.0.0 up to but not including 6.2.2) 2. 15 July 2026[We published: Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru](https://mysites.guru/blog/quix-sql-injection-disclosure/) 3. 20 July 2026CVE-2026-60029 record published by its CNA ## Rule details High[CVE-2026-58078](https://mysites.guru/vulnerabilities/CVE-2026-58078/)[CVE-2026-60026](https://mysites.guru/vulnerabilities/CVE-2026-60026/)[CVE-2026-60027](https://mysites.guru/vulnerabilities/CVE-2026-60027/)[CVE-2026-60028](https://mysites.guru/vulnerabilities/CVE-2026-60028/)[CVE-2026-60029](https://mysites.guru/vulnerabilities/CVE-2026-60029/)[CVE-2026-60030](https://mysites.guru/vulnerabilities/CVE-2026-60030/)[CVE-2026-60031](https://mysites.guru/vulnerabilities/CVE-2026-60031/)2026-07-15 [Quix Page Builder](https://mysites.guru/vulnerabilities/quix/) Affected versions: ≥ 1.0.0 and < 6.2.2 Full advisory: [our disclosure post](https://mysites.guru/blog/quix-sql-injection-disclosure/) ## Our disclosure post [![Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru](https://mysites.guru/_astro/quix-sql-injection-disclosure.DLw2kXwe_2uPRqx.webp) ### Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru mySites.guru found and reported CVE-2026-58078, an unauthenticated SQL injection in Quix Page Builder for Joomla. Fixed in 6.2.1; update to 6.2.2. 15 Jul 2026 ](https://mysites.guru/blog/quix-sql-injection-disclosure/) ## Other vulnerabilities in Quix Page Builder Updating for CVE-2026-60029 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [Quix Page Builder](https://mysites.guru/vulnerabilities/quix/) Latest safe version: 6.3.4 - [CVE-2026-58078](https://mysites.guru/vulnerabilities/CVE-2026-58078/) High, from 1.0.0 up to but not including 6.2.2 - [CVE-2026-60026](https://mysites.guru/vulnerabilities/CVE-2026-60026/) High, from 1.0.0 up to but not including 6.2.2 - [CVE-2026-60027](https://mysites.guru/vulnerabilities/CVE-2026-60027/) High, from 1.0.0 up to but not including 6.2.2 - [CVE-2026-60028](https://mysites.guru/vulnerabilities/CVE-2026-60028/) High, from 1.0.0 up to but not including 6.2.2 - [CVE-2026-60030](https://mysites.guru/vulnerabilities/CVE-2026-60030/) High, from 1.0.0 up to but not including 6.2.2 - [CVE-2026-60031](https://mysites.guru/vulnerabilities/CVE-2026-60031/) High, from 1.0.0 up to but not including 6.2.2 ## References - [CVE-2026-60029 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-60029) - [CVE-2026-60029 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-60029) - [Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru](https://mysites.guru/blog/quix-sql-injection-disclosure/) ## CVE-2026-60029 questions Show all Which versions are affected by CVE-2026-60029? [CVE-2026-60029](https://mysites.guru/vulnerabilities/CVE-2026-60029/) affects Quix Page Builder from 1.0.0 up to but not including 6.2.2. The fix is in 6.2.2. How do I fix CVE-2026-60029? Update Quix Page Builder to 6.2.2 for this flaw, or to 6.3.4 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen. How severe is CVE-2026-60029? Joomla CNA scores it 5.1 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, needs an account with elevated rights and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.