Quix Page Builder (com_quix) below 6.2.2 - CVE-2026-58078 (CVSS 8.7) Unauthenticated SQL Injection (database read), Code Execution, Path Traversal and Stored XSS
Quix Page Builder before 6.2.1 contains an unauthenticated SQL injection in the joomla-article builder element. An article id taken directly from a request parameter is concatenated into a database query with no integer cast or escaping, and the AJAX handler reflects the database error back to the caller, so an anonymous attacker with no login and no CSRF token can read arbitrary data from the site database, including user password hashes and the Joomla secret. This is the error-based kind of injection, so the data returns in the response rather than having to be inferred a bit at a time. Discovered and reported to ThemeXpert by mySites.guru (Phil Taylor), and confirmed against the Quix Pro 6.2.0 release. It is tracked as CVE-2026-58078, assigned by the Joomla CNA (CVSS 4.0 8.7, High), crediting Phil Taylor of mySites.guru as the finder. Quix 6.2.1 fixes this by casting the id to an integer before it reaches the query. Quix 6.2.1 also fixes five further security issues reported by mySites.guru in the same disclosure: a code-execution path via the Raw HTML element (PHP tags in element content are now neutralised), a path traversal and arbitrary file read in the Form element submission handler, stored XSS through the icon field including inline SVG, a missing permission check on the admin media manager endpoint, and the reflection of internal error details in front-end AJAX responses. ThemeXpert shipped 6.2.1 on 15 July 2026, the same day the issues were reported, and also hardened the bundled JMedia media manager in 1.6.1 (blocking executable and polyglot uploads and remote-URL SSRF, sanitising uploaded SVG, and serving files with hardened headers). Fix: update Quix to 6.2.1 or later, and update JMedia to 1.6.1 or later if installed. One update closes all six issues. A web application firewall with SQL injection filtering enabled will block the injection payload, but that buys time and is not a fix. Also covered by this rule, all affecting Quix Page Builder Pro 1.0 to 6.2.0 and fixed in the same release: CVE-2026-60026 (authenticated PHP code execution via element content executed through the view-cache include, requires caching on, which is the default), CVE-2026-60027 (unauthenticated path traversal via form elements allowing arbitrary file read, requires a published page with a Form element), CVE-2026-60028 and CVE-2026-60029 (authenticated stored XSS via unescaped output, unsanitised SVG and id/class fields that render for public users), CVE-2026-60030 (authenticated users could upload media regardless of their media management permissions) and CVE-2026-60031 (information disclosure through raw exceptions reflected in AJAX handler responses).
Affected versions: ≥ 1.0.0 and < 6.2.2
Full advisory: our disclosure post
