Executive brief
QloApps, an open-source hotel booking and reservation system, contains a security flaw in its administrative file management tool. An authorized administrator can upload specially crafted image files (SVG) containing hidden malicious code. If another user or administrator views these files, the code executes in their browser, potentially allowing for unauthorized actions or data theft within the management console.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in QloApps versions up to and including 1.7.0. The flaw is located in the admin file manager, which fails to properly sanitize uploaded Scalable Vector Graphics (SVG) files. An authenticated attacker with administrative privileges can embed JavaScript event handlers (e.g., 'onload') within an SVG file. When this file is subsequently viewed by another user, the malicious script executes within the context of that user's session. This can lead to session hijacking or unauthorized administrative actions. Recommended mitigations include implementing SVG sanitization or enforcing a strict Content Security Policy (CSP).
Affected products
- QloApps QloApps through 1.7.0
Timeline
- 2026-06-03: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: NVD and VulnCheck published advisory details