QloApps CVE-2026-25558

Exploitation requires an authenticated QloApps administrator account with access to the admin file manager - the CVSS PR:H rating confirms high privileges are mandatory, meaning unauthenticated or low-privileged users cannot trigger the upload. The attacker must be permitted to upload files through the file manager interface; if SVG uploads are blocked by file-type restrictions or the file manager feature is disabled, exploitation is prevented at the upload stage. Victim user interaction is required (UI:R): a separate user must navigate to or preview the uploaded SVG in a browser for the payload to execute. Exploitation is therefore limited to insider threat scenarios, compromised administrator credentials, or multi-admin environments where one admin can target others or staff users. The attack does not require a privileged network position (AV:N, AC:L), meaning any internet-accessible QloApps admin panel is reachable once credentials are obtained.

The CVSS 4.8 Medium score is shaped by two key mitigating factors: PR:H (high privileges - admin account required to upload) and UI:R (a victim must view the file). These significantly narrow the realistic attack surface compared to a PR:N or UI:N vulnerability. The scope change (S:C) is the most consequential signal here - once a malicious SVG is uploaded, the impact extends to any user who views it, not just the uploader, amplifying blast radius beyond the admin context. No EPSS score was provided, so exploitation probability cannot be quantitatively compared. No CISA KEV listing is present, indicating no confirmed mass exploitation. However, a publicly available proof-of-concept on GitHub lowers the technical bar for abuse, particularly in insider threat or compromised-admin scenarios. For organizations running QloApps with multiple administrators or staff access to the file manager, the risk is elevated above what raw CVSS suggests. This is not a zero-effort remote exploit, but it is a credible threat in environments where admin account hygiene is imperfect.

An attacker with a compromised or rogue QloApps administrator account logs into the admin panel and uploads a crafted SVG file - for example, one containing an img element with an onload handler that exfiltrates document.cookie to an attacker-controlled server. The file is stored by the application without sanitization. When a hotel staff member or another administrator later browses the file manager and previews the uploaded file, the JavaScript executes in their browser, silently stealing their session token. A public proof-of-concept demonstrating this technique is referenced in the GitHub issue, confirming practical exploitability.