CVE-2026-75496

HIGH 7.2

Webkul QloApps improper file upload validation

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

CWE	CWE-434
Vendor	webkul
Product	qloapps
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for webkul qloapps

Be the first to know when new high vulnerabilities affecting webkul qloapps are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Webkul / QloApps

0 < 153ec1c

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Qloapps/QloApps/pull/1801/commits/153ec1c8567798bd99155098ecc0a340e38f25bf raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-237-01.json cve.org: https://www.cve.org/CVERecord?id=CVE-2026-75496

Credits

leediay153