EUVD-2026-83616
GHSA-pjph-5h96-886c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged back-office login
-
DeliverySend getEmailHTML AJAX request to admin/ajax.php
-
ExploitInject ../ traversal in email parameter
-
ExecutionRead arbitrary file outside mail dir
-
ImpactExfiltrate DB credentials and config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated QloApps back-office (admin panel) user session (PR:L) - any privilege level able to reach the getEmailHTML action of admin/ajax.php. The attacker supplies relative path sequences ('../') in the 'email' parameter; the vulnerable AdminTranslationsController::getEmailHTML calls file_get_contents on the path without confirming it resolves within _PS_MAIL_DIR_. Limiting factors: exploitation is gated on valid back-office authentication (not pre-auth), affects QloApps versions through 1.7.0, and is neutralized once the vendor patch (PR #1719 / commit 8015495c) adding realpath()+_PS_MAIL_DIR_ prefix validation is applied. No special non-default configuration is otherwise needed. |
| Impact | This is a moderate, realistically-exploitable issue rather than a critical emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N = 7.1) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated back-office account), no user interaction, and high confidentiality impact with no integrity or availability impact - appropriate for an arbitrary-file-read flaw. The key limiting signal is PR:L: exploitation requires a valid authenticated back-office (admin panel) session, so this is not a pre-auth internet-wide bug. Positive escalation signals: a public exploit write-up exists (hackmd.io) and a vendor patch is available (PR #1719), and it was reported by VulnCheck, a credible source. No EPSS score is provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation - the risk is 'plausible and documented' rather than 'observed in the wild.' Because the leaked data explicitly includes database credentials and configuration, the confidentiality impact (VC:H) is justified and can serve as a stepping stone to fuller compromise, which raises the practical priority for any exposed QloApps instance despite the authentication requirement. |
| Exploit ScenarioDerived | An attacker with any low-privileged back-office account (or one obtained via a compromised/weak staff credential) sends a crafted AJAX request to admin/ajax.php invoking the getEmailHTML action with an 'email' parameter containing '../' traversal sequences. The application calls file_get_contents on the attacker-controlled path without validating it stays within the mail directory, returning arbitrary files such as settings.inc.php containing database credentials. A public proof-of-concept write-up already documents this technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
RemediationAI
Apply the upstream fix: QloApps pull request #1719 (commit 8015495ca746127920fbcde1f9507c024b26a715) adds realpath() validation against _PS_MAIL_DIR_ in AdminTranslationsController::getEmailHTML and is the authoritative remediation; because the fix is delivered as a PR/commit rather than a confirmed tagged release, verify the change is present in whatever build you deploy or cherry-pick the commit into your installation, and track https://github.com/Qloapps/QloApps for the corresponding released version. If immediate patching is not possible, reduce exposure by restricting the back office to trusted networks or VPN and enforcing MFA and strict least privilege on admin accounts, since the vulnerability is only reachable with a valid authenticated back-office session; a WAF or reverse-proxy rule that rejects requests to admin/ajax.php whose email parameter contains traversal sequences ('../' or encoded equivalents) will block the known exploitation pattern, with the trade-off of possible false positives on legitimate template names, so validate against real traffic before enforcing. Monitoring and alerting on file-read requests from the getEmailHTML action and rotating any secrets (database credentials, API keys) that were stored in plaintext in configuration files on unpatched hosts is advisable, because a successful read may already have exposed them and patching alone does not undo that disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory ('path traversal'), implemented in PHP. QloApps exposes an administrative AJAX endpoint, admin/ajax.php, whose getEmailHTML action reads an email template file. The implementation in AdminTranslationsController::getEmailHTML takes the caller-supplied 'email' value, concatenates it into a filesystem path and calls file_get_contents on the result, with no check that the resolved path remains beneath the mail directory constant _PS_MAIL_DIR_. Supplying '../' sequences in the parameter therefore escapes the intended mail-template folder and resolves to arbitrary readable files on the host, such as configuration files that hold database credentials. The upstream fix confirms the root cause: it introduces realpath() on both the requested file and _PS_MAIL_DIR_, then requires that the resolved file path begin with the resolved permitted directory prefix before reading it. The same pull request also tightens adjacent translation-archive import logic (extension allow-listing and stricter filename regexes), indicating the maintainers hardened the broader file-handling surface around this controller. The CVSS 4.0 vector in the source data records AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality impact only and no integrity or availability impact, which matches the read-only nature of the primitive; the independent assessment expresses the same profile under CVSS 3.1 (PR:L, C:H/I:N/A:N).
Know when Qloapps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable AJAX endpoint requiring an authenticated back-office account (PR:L), no user interaction; arbitrary file read yields high confidentiality (DB creds) with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Technical POC Analysis
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
QloApps deployments at version 1.7.0 and earlier expose back-office users to a file-read flaw that can reveal configuration and database credentials, giving limited-privilege administrative accounts access well beyond their intended scope. Publicly available exploit code exists, so unpatched installations face elevated risk, though the impact is constrained by the need for back-office access. Leadership should prioritize patching and credential review because a compromised or malicious back-office account could pivot into broader database and configuration compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_p
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploadi
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remo
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScrip
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executa
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credenti
Exploit-DB