CVE-2026-93988— QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
Quick assessment
Affected
webkul qloapps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QloApps 1.7.0 及之前版本中，admin/ajax.php 的 getEmailHTML 接口存在路径遍历漏洞，使得已认证的后台用户能够读取任意文件。攻击者可通过在 email 参数中提供相对路径序列来绕过目录限制，从而访问敏感文件，包括数据库凭据和配置数据。
Possible ATT&CK Techniques 1 AI
T1195 · Supply Chain Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93988
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
Source: CVE Program / CVE List V5
Vulnerability Description
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93988
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93988
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-93988 (2)
Vendor Advisories for CVE-2026-93988 (1)
Exploits & Public PoCs for CVE-2026-93988 (1)
-
🔗 QloApps 1.7.0 getEmailHTML Arbitrary File Read - HackMD Read full article third-party-advisory exploit
IV. Related Vulnerabilities
Same product: qloapps
-
CVE-2026-92234
QloApps through 1.7.0 Reflected XSS via Hotel Feature Valida -
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-75498
Webkul QloApps SQL injection -
CVE-2026-75497
Webkul QloApps SQL injection -
CVE-2026-75496
Webkul QloApps improper file upload validation
Same vendor: webkul
-
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note -
CVE-2026-92234
QloApps through 1.7.0 Reflected XSS via Hotel Feature Valida -
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Paramete -
CVE-2026-75498
Webkul QloApps SQL injection -
CVE-2026-75497
Webkul QloApps SQL injection
Same weakness: CWE-22
-
CVE-2026-93992
Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Tr -
CVE-2026-93986
rclone before 1.75.1 Path Traversal via Directory Listing Na -
CVE-2026-85272
Open edX Platform: Path traversal via prefix-bypass in safe_ -
CVE-2026-84086
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-82896
IBM Guardium Data Protection is affected by multiple vulnera
V. Comments for CVE-2026-93988
No comments yet