CVE-2026-89268: QloApps through 1.7.0 Reflected XSS via List Filter Parameters
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated back-office users who can be induced to submit a crafted POST request to a list controller are exposed. Successful exploitation runs JavaScript in the victim's authenticated session.
What access and interaction does an attacker need?
The attacker needs low-level privileges and must persuade an authenticated user to submit a malicious POST request containing crafted list-filter parameters. The vulnerability is network-reachable and has low attack complexity.
What could successful exploitation allow?
JavaScript executing in the victim's session can read administrative data and perform actions with that user's permissions. The stated impact includes low confidentiality and integrity impact, with no availability impact.
Which versions are affected?
QloApps through version 1.7.0 is affected.