Medium severity · published Jun 8, 2026
CVE-2026-25558
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
QloApps · QloApps
through 1.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25558
github.com
https://github.com/Qloapps/QloApps/issues/1728
www.vulncheck.com
https://www.vulncheck.com/advisories/qloapps-stored-xss-via-svg-file-upload-in-admin-file-manager
More from QloApps
6.5
CVE-2026-116745
QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
5.9
CVE-2026-25861
QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
5.3
CVE-2026-116746
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview