CVE-2025-67325: Malicious File Upload
Published Jan 8, 2026
·Updated
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
Affected Software
2 affected components
QloApps QloApps<=1.7.0
Webkul QloApps<=1.7.0
Event History
Jan 8, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67325?
CVE-2025-67325 has a high severity rating due to the potential for remote code execution through unrestricted file uploads.
2
How do I fix CVE-2025-67325?
To fix CVE-2025-67325, upgrade QloApps to a version later than 1.7.0.
3
Who is affected by CVE-2025-67325?
CVE-2025-67325 affects all users of QloApps versions 1.7.0 and earlier.
4
What types of attacks can result from CVE-2025-67325?
Exploitation of CVE-2025-67325 can lead to remote code execution, allowing attackers to perform malicious actions on the server.
5
Is authentication required to exploit CVE-2025-67325?
No, CVE-2025-67325 can be exploited by remote unauthenticated attackers.