CVE-2026-93988
MEDIUMCVSS 6.5Description
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Timeline
Published:September 19th, 2026 11:17 PM
Last modified:September 22nd, 2026 8:43 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/Qloapps/QloApps
- https://github.com/Qloapps/QloApps/blob/f768898c20c43cb0733a6099e390e5be71631393/controllers/admin/AdminTranslationsController.php#L3038-L3051
- https://github.com/Qloapps/QloApps/commit/8015495ca746127920fbcde1f9507c024b26a715
- https://github.com/Qloapps/QloApps/pull/1719
- https://hackmd.io/@leediay/qloapps-arbitrary-file-read-via-path-traversal
- https://www.vulncheck.com/advisories/qloapps-through-1.7.0-arbitrary-file-read-via-getemailhtml
Source: NIST NVD · Data may lag official sources by up to one minute