Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site
CVE-2026-60031MediumCVSS 6.9CVE published 20 July 2026Added to mySites.guru 15 July 2026

Quix Page Builder (com_quix) below 6.2.2 - CVE-2026-58078 (CVSS 8.7) Unauthenticated SQL Injection (database read), Code Execution, Path Traversal and Stored XSS

Quix Page Builder before 6.2.1 contains an unauthenticated SQL injection in the joomla-article builder element. An article id taken directly from a request parameter is concatenated into a database query with no integer cast or escaping, and the AJAX handler reflects the database error back to the caller, so an anonymous attacker with no login and no CSRF token can read arbitrary data from the site database, including user password hashes and the Joomla secret. This is the error-based kind of injection, so the data returns in the response rather than having to be inferred a bit at a time. Discovered and reported to ThemeXpert by mySites.guru (Phil Taylor), and confirmed against the Quix Pro 6.2.0 release. It is tracked as CVE-2026-58078, assigned by the Joomla CNA (CVSS 4.0 8.7, High), crediting Phil Taylor of mySites.guru as the finder. Quix 6.2.1 fixes this by casting the id to an integer before it reaches the query. Quix 6.2.1 also fixes five further security issues reported by mySites.guru in the same disclosure: a code-execution path via the Raw HTML element (PHP tags in element content are now neutralised), a path traversal and arbitrary file read in the Form element submission handler, stored XSS through the icon field including inline SVG, a missing permission check on the admin media manager endpoint, and the reflection of internal error details in front-end AJAX responses. ThemeXpert shipped 6.2.1 on 15 July 2026, the same day the issues were reported, and also hardened the bundled JMedia media manager in 1.6.1 (blocking executable and polyglot uploads and remote-URL SSRF, sanitising uploaded SVG, and serving files with hardened headers). Fix: update Quix to 6.2.1 or later, and update JMedia to 1.6.1 or later if installed. One update closes all six issues. A web application firewall with SQL injection filtering enabled will block the injection payload, but that buys time and is not a fix. Also covered by this rule, all affecting Quix Page Builder Pro 1.0 to 6.2.0 and fixed in the same release: CVE-2026-60026 (authenticated PHP code execution via element content executed through the view-cache include, requires caching on, which is the default), CVE-2026-60027 (unauthenticated path traversal via form elements allowing arbitrary file read, requires a published page with a Form element), CVE-2026-60028 and CVE-2026-60029 (authenticated stored XSS via unescaped output, unsanitised SVG and id/class fields that render for public users), CVE-2026-60030 (authenticated users could upload media regardless of their media management permissions) and CVE-2026-60031 (information disclosure through raw exceptions reflected in AJAX handler responses).

Is my site affected?

Affected
Quix Page Builder from 1.0.0 up to but not including 6.2.2
Fixed in
6.2.2
What to do
Update Quix Page Builder to 6.2.2 for this flaw, or to 6.3.4 or later, which no rule we check matches.
Check whether your sites are affected

How CVE-2026-60031 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

6.9 Medium

CVSS 4.0, scored by Joomla CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
AT:N Attack requirements
None. Works against any affected install
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything

What it does to the site

VC:L Confidentiality
Low. Some data can be read
VI:N Integrity
None. Nothing can be altered
VA:N Availability
None. The site stays up

What it does beyond the site

SC:N Confidentiality
None. Other systems keep their data
SI:N Integrity
None. Other systems keep their integrity
SA:N Availability
None. Other systems stay up

The rule below is rated High for the set of 7 CVEs it covers together, not for this record on its own.

Timeline

  1. 15 July 2026mySites.guru check added for Quix Page Builder (from 1.0.0 up to but not including 6.2.2)
  2. 15 July 2026We published: Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru
  3. 20 July 2026CVE-2026-60031 record published by its CNA

Rule details

Our disclosure post

Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru

Unauthenticated SQL Injection in Quix Page Builder found by mySites.guru

mySites.guru found and reported CVE-2026-58078, an unauthenticated SQL injection in Quix Page Builder for Joomla. Fixed in 6.2.1; update to 6.2.2.

Other vulnerabilities in Quix Page Builder

Updating for CVE-2026-60031 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

Quix Page Builder

Latest safe version: 6.3.4

References

CVE-2026-60031 questions

Which versions are affected by CVE-2026-60031?
CVE-2026-60031 affects Quix Page Builder from 1.0.0 up to but not including 6.2.2. The fix is in 6.2.2.
How do I fix CVE-2026-60031?
Update Quix Page Builder to 6.2.2 for this flaw, or to 6.3.4 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-60031?
Joomla CNA scores it 6.9 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 24 October 2026.