CVE-2026-93988: QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a QloApps back-office user. The vulnerable endpoint is admin/ajax.php, so unauthenticated external users are not described as able to exploit it.
What access can exploitation provide?
A permitted back-office user can use relative path sequences in the email parameter of the getEmailHTML action to read arbitrary files. Exposed files may include database credentials and configuration data.
How can I determine whether my deployment is affected?
QloApps versions through 1.7.0 are affected. Review whether back-office accounts can access admin/ajax.php and whether the getEmailHTML action accepts attacker-controlled values in the email parameter.