Description
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webkul | QloApps | < 153ec1c | 153ec1c |
Advisories 1
- VA-26-237-01 Webkul QloApps multiple vulnerabilities CISA ICS & IT advisories · Aug 25, 2026