Read the docs
TI-2026-20665 Aliases CVE-2026-25558GHSA-xcx6-j7v3-9h57

QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QloAppsQloAppsup to 1.7.0—No fix listedCNA
  • QloApps VendorQloApps Affected up to 1.7.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25558
  2. 2026-10-03 Alias added: GHSA-xcx6-j7v3-9h57

References

Other 1

  • TI-2026-80955 Missing authorization in QloApps qlohotelreview lets attackers post fake reviews CVSS 4.0MEDIUM 6.9
  • TI-2026-80954 Guest order disclosure via id_cart in QloApps order confirmation CVSS 4.0MEDIUM 6.9
  • TI-2026-20905 QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences