Description

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T23:17:09.890Z",
  "pubdate": "2026-09-19T23:17:09.890Z",
  "executiveSummary": "QloApps versions through 1.7.0 are susceptible to a critical path traversal vulnerability located within the admin/ajax.php script. This flaw arises from improper validation of user-supplied input when handling file retrieval requests via the getEmailHTML action.\nBy manipulating the email parameter with relative path sequences, an authenticated back-office user can circumvent intended directory constraints to traverse the filesystem. This vulnerability permits the unauthorized reading of arbitrary files on the underlying server, including highly sensitive configuration files and database credentials.\nThe risk implication is severe, as successful exploitation facilitates full system reconnaissance, credential theft, and potentially complete compromise of the QloApps environment. The attack is restricted to authenticated back-office users, requiring valid administrative access to the platform to initiate the exploit. No external, unauthenticated exposure is necessary, yet the impact remains significant due to the sensitive nature of the exposed configuration data.",
  "technicalDetails": "The vulnerability resides in the admin/ajax.php component of QloApps, specifically within the logic processing the getEmailHTML action. The root cause is the insufficient sanitization and validation of the email parameter before it is passed to file-system-level operations. The application fails to effectively neutralize directory traversal sequences, such as '../', allowing a user to break out of the designated directory scope.\nExploitation is achieved by submitting a crafted HTTP request to admin/ajax.php where the email parameter contains a sequence of parent directory references. For instance, an attacker could supply a payload like '../../../config/settings.inc.php' to traverse the directory tree from the expected location to sensitive areas of the application structure. When the server-side script processes this input, the path concatenation results in a resolved absolute path pointing to a file outside the intended web root.\nThe attack flow follows a predictable pattern: first, the authenticated attacker identifies the target file they wish to exfiltrate; second, they construct a path traversal string calibrated to the server's directory depth relative to the vulnerable script; third, the malicious payload is transmitted as the value for the email parameter within an AJAX request; finally, the server returns the contents of the target file in the response body or as part of the processed HTML template, which the attacker then retrieves.\nThis vulnerability is particularly dangerous because it grants access to configuration files, which in a QloApps installation typically contain database hostnames, usernames, and plaintext passwords. Possession of these credentials provides the attacker with direct access to the backend database, potentially leading to total platform control. Furthermore, reading other arbitrary system files enables the extraction of environment-specific secrets, which can be leveraged for lateral movement or privilege escalation within the broader server environment. Because the vulnerability exists within the application's internal AJAX handler, it bypasses standard client-side input validation and security controls."
}