Remote Code Execution Vulnerability in Webkul QloApps
CVE-2026-75496

8.6HIGH

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
25 August 2026

What is CVE-2026-75496?

Webkul QloApps is susceptible to a significant security issue stemming from inadequate validation of uploaded file extensions and MIME types. This flaw allows authenticated attackers with administrative privileges to upload and execute malicious files on the server. The vulnerability presents a critical risk as it can lead to unauthorized remote code execution, compromising the integrity and security of the application. It is essential for users of QloApps to apply the patch provided in commit 153ec1c to mitigate this risk.

Affected Version(s)

QloApps 0 < 153ec1c

QloApps 153ec1c

References

https://github.com/Qloapps/QloApps/pull/1801/commits/153e...
patch
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-75496
vdb-entry

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153
.