CVE-2026-25558: QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-08 · updated 2026-07-23
Weakness: CWE-79

Description

QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.

Affected products

QloApps: through 1.7.0

References

https://github.com/Qloapps/QloApps/issues/1728
https://www.vulncheck.com/advisories/qloapps-stored-xss-via-svg-file-upload-in-admin-file-manager

Get alerted when CVE-2026-25558 or the next vulnerability affects your stack