Skip to main content

QloApps CVE-2026-75496

| EUVDEUVD-2026-65585 HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2026-08-25 cisa-cg GHSA-2q2p-6wq8-66hp
File Upload RCE Qloapps
8.6
CVSS 4.0 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.2 HIGH

Admin authentication required (PR:H); no scope change since the admin context already owns the system; full C/I/A impact from arbitrary code execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 25, 2026 - 17:31 vuln.today
Analysis Generated
Aug 25, 2026 - 17:31 vuln.today
CVSS changed
Aug 25, 2026 - 17:22 NVD
7.2 (HIGH) 8.6 (HIGH)
CVE Published
Aug 25, 2026 - 16:36 cve.org
HIGH 8.6

DescriptionCVE.org

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

AnalysisAI

Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain admin credentials via phishing or reuse
Delivery
Authenticate to QloApps admin panel
Exploit
Upload PHP webshell via booking document upload endpoint
Execution
Server moves file to publicly accessible directory without validation
Persist
Request webshell URL via HTTP
Impact
Execute arbitrary server-side code as web process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires valid QloApps administrative credentials; the CVSS 4.0 PR:H metric confirms high-privilege authentication is a hard prerequisite with no bypass path described. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately conveys the technical severity while the PR:H metric is the key constraining factor: exploitation is gated behind valid administrative credentials, which limits the realistic exploitable population to credential-compromised admins or malicious insiders. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has acquired QloApps administrative credentials - via phishing, credential stuffing against a reused password, or insider access - logs into the admin panel and navigates to the hotel booking document upload interface. The attacker uploads a PHP webshell with a `.php` extension (or any executable extension), which bypasses the absent server-side validation and is moved to a publicly accessible directory on the web server. …
Remediation Apply the upstream fix from commit 153ec1c available at https://github.com/Qloapps/QloApps/pull/1801/commits/153ec1c8567798bd99155098ecc0a340e38f25bf, which replaces client-controlled file type metadata with server-side content inspection. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit your QloApps deployment to confirm version status; implement strict web server permissions restricting write access to upload directories; disable the booking document upload feature temporarily if operationally feasible pending remediation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Qloapps

View all
CVE-2025-67325 CRITICAL POC
9.8 Jan 08

QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature
CVE-2023-36284 HIGH POC
7.5 Jun 23

An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_p
CVE-2024-40318 HIGH POC
7.2 Jul 25

An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploadi
CVE-2023-36287 MEDIUM POC
6.1 Jun 23

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
CVE-2023-36289 MEDIUM POC
6.1 Jun 23

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
CVE-2023-30256 MEDIUM POC
6.1 May 11

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
CVE-2025-10759 MEDIUM POC
5.5 Sep 21

A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remo
CVE-2023-36288 MEDIUM POC
5.4 Jun 23

An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
CVE-2025-1155 MEDIUM POC
5.3 Feb 10

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3
CVE-2026-25558 MEDIUM POC
4.8 Jun 08

Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScrip
CVE-2026-75498 HIGH
8.6 Aug 25

SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credenti
CVE-2026-75497 HIGH
8.6 Aug 25

SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsani

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

CVE-2026-75496 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy