CVE-2026-93988
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Risk Assessment
An attacker can access critical data such as database credentials, potentially leading to full system compromise.
Recommendation
Update QloApps to a version later than 1.7.0. Restrict back-office user permissions.
Other vulnerabilities in QloApps
See all- CVE-2025-67325Critical
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- CVE-2026-92234Medium
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
- CVE-2026-89268Medium
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
- CVE-2026-25558Medium
QloApps through version 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager. Authenticated administrators can inject malicious JavaScript by uploading crafted SVG files with embedded event handlers such as onload.
- CVE-2026-25861Medium
QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.
Original NVD description (English source)
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS