CVE-2026-25558: QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable uploading of SVG files through the admin file manager until an official vendor fix is available.
QloApps admin file manager allow_svg_uploads = false - Configuration
Implement server-side validation/sanitization of SVG uploads to remove any embedded JavaScript, script elements, and event handler attributes before storing or serving files.
QloApps admin file manager svg_sanitization = strip scripts and event handler attributes (e.g. onload) from uploaded SVGs - Compensating control
Restrict access to the admin file manager to trusted IP addresses and/or a VPN and enforce strong admin authentication (limit admin accounts, use MFA) to reduce risk from abused administrator accounts.
- Operational
Scan existing uploaded files for SVGs containing script elements or event-handler attributes; remove or sanitize any malicious SVG files found and notify administrators who uploaded or accessed them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25558?
The severity of CVE-2026-25558 is medium with a score of 4.8.
How do I fix CVE-2026-25558?
To fix CVE-2026-25558, update QloApps to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-25558?
CVE-2026-25558 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-25558?
Authenticated administrators using QloApps versions prior to 1.7.0 are affected by CVE-2026-25558.
What can attackers do with CVE-2026-25558?
Attackers can exploit CVE-2026-25558 to inject malicious JavaScript into the application by uploading specially crafted SVG files.