CVE-2026-25558
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
QloApps through version 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager. Authenticated administrators can inject malicious JavaScript by uploading crafted SVG files with embedded event handlers such as onload.
Risk Assessment
An attacker can execute arbitrary scripts in the browser of any user viewing the malicious SVG file, potentially leading to session theft, content modification, or further attacks.
Recommendation
Update QloApps to the latest version that fixes this vulnerability. Restrict SVG file uploads for administrators if not required.
Other vulnerabilities in QloApps
See all- CVE-2025-67325Critical
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- CVE-2026-25861Medium
QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.
Original NVD description (English source)
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.