CVE-2026-93988

EUVD-2026-83616
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 30.97%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
webkulqloapps
𝑥
≤ 1.7.0
CNA
Common Weakness Enumeration
References
https://github.com/Qloapps/QloApps
https://github.com/Qloapps/QloApps/blob/f768898c20c43cb0733a6099e390e5be71631393/controllers/admin/AdminTranslationsController.php#L3038-L3051
https://github.com/Qloapps/QloApps/commit/8015495ca746127920fbcde1f9507c024b26a715
https://github.com/Qloapps/QloApps/pull/1719
https://hackmd.io/@leediay/qloapps-arbitrary-file-read-via-path-traversal
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-arbitrary-file-read-via-getemailhtml