CVE-2026-93988

Received Received - Intake

Path Traversal in QloApps via admin/ajax.php Email Parameter

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93988

Affected Vendors & Products

Vendor	Product	Version / Range
qloapps	qloapps	1.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

QloApps through version 1.7.0 has a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. This flaw allows authenticated back-office users to read arbitrary files by supplying relative path sequences in the email parameter. Attackers can bypass directory restrictions to access sensitive files such as database credentials and configuration data.

Detection Guidance

To detect this vulnerability, check for unauthorized access to sensitive files via admin/ajax.php. Look for unusual GET requests with relative path sequences in the email parameter. Monitor logs for paths containing ../ or similar traversal sequences targeting files like config/settings.inc.php or similar configuration files.

Impact Analysis

This vulnerability allows attackers with back-office access to read sensitive files on the server. This could lead to exposure of confidential data like database credentials, configuration files, or other critical system information. The impact includes potential data breaches, unauthorized access to system resources, and compromise of the entire application.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations subject to these regulations.

Mitigation Strategies

Immediately update QloApps to the latest version beyond 1.7.0. Restrict access to admin/ajax.php to trusted IPs. Review server logs for signs of exploitation. Remove or disable the vulnerable getEmailHTML action if an update is not immediately available.

Hi! I’m here to help you understand CVE-2026-93988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70