Vulnerability · Published Sep 19, 2026 · Assigned by VulnCheck
CVE-2026-93988QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
Medium 6.5
In plain English
A medium-severity path traversal in qloapps from webkul. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GitHub PR #1719 issue-tracking, patch
- https://github.com/Qloapps/QloApps/commit/8015495ca746127920fbcde1f9507c024b26a715 patch
- getEmailHTML at v1.7.0 technical-description
- https://hackmd.io/@leediay/qloapps-arbitrary-file-read-via-path-traversal third-party-advisory, exploit
- https://github.com/Qloapps/QloApps product
- VulnCheck Advisory: QloApps through 1.7.0 Arbitrary File Read via getEmailHTML third-party-advisory