Medium severity · published Sep 19, 2026
CVE-2026-93988
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
qloapps · webkul
through 1.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93988
issue-tracking
https://github.com/Qloapps/QloApps/pull/1719
patch
https://github.com/Qloapps/QloApps/commit/8015495ca746127920fbcde1f9507c024b26a715
technical-description
https://github.com/Qloapps/QloApps/blob/f768898c20c43cb0733a6099e390e5be71631393/controllers/admin/AdminTranslationsController.php#L3038-L3051
third-party-advisory
https://hackmd.io/@leediay/qloapps-arbitrary-file-read-via-path-traversal
product
https://github.com/Qloapps/QloApps
third-party-advisory
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-arbitrary-file-read-via-getemailhtml
More from qloapps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation