CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
Explanation of Vulnerability in Simple Terms
The Quix Page Builder Pro extension for Joomla contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft a malicious request to access sensitive files outside the intended directory, potentially exposing configuration files, database credentials, or other confidential data. No user interaction is required to exploit this vulnerability.
What an attacker can do
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
Sensitive files like database credentials and configuration may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the Joomla site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
