CVE Catalog
CVE-2025-67325
CriticalSummary
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
Risk Assessment
The risk includes the possibility of remote code execution by an unauthenticated attacker, which can lead to full compromise of the application and server, data theft, or service disruption.
Recommendation
It is recommended to immediately upgrade QloApps to a version later than 1.7.0 and implement restrictions on file types and sizes for uploads.
Original NVD description (English source)
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.