CVE-2026-93988

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1

Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email parameter, an attacker can bypass directory restrictions to access sensitive information, such as configuration data and database credentials. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update QloApps to version 1.7.1 or later. As a temporary mitigation, restrict access to the email parameter within the 'admin/ajax.php' endpoint.