CVE-2026-110219: QloApps Reflected XSS Vulnerability

CVE-2026-110219 Overview

CVE-2026-110219 is a reflected cross-site scripting (XSS) vulnerability in QloApps through version 1.7.0. The flaw resides in the back-office Additional Facilities form, specifically in the handling of the price parameter. When input validation fails, the unescaped price value is re-rendered in the administrative response, allowing attacker-supplied JavaScript to execute in the context of an authenticated back-office session. The vulnerability is tracked under CWE-79 and requires user interaction from a logged-in administrator.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in an authenticated administrator's browser session, enabling session abuse, administrative action forgery, and theft of back-office data.

Affected Products

QloApps hotel reservation system through version 1.7.0
The hotelreservationsystem module, controller AdminRoomTypeGlobalDemand.php
Smarty template room_type_global_demand/helpers/form/form.tpl

Discovery Timeline

2026-10-13 - CVE-2026-110219 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110219

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the QloApps Additional Facilities form inside the back-office hotel reservation module. An authenticated back-office user submits the form, and the server-side validation routine in AdminRoomTypeGlobalDemand.php rejects a malformed price value. Instead of sanitizing or encoding the submitted value, the application re-renders the form through the Smarty template at form.tpl with the raw price input echoed into the HTML response. Any JavaScript payload supplied in the price field is parsed and executed by the administrator's browser. Attackers typically chain this with social-engineering techniques to trick an authenticated administrator into submitting a crafted request.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The affected controller returns user-supplied data to the Smarty template without applying contextual HTML escaping. The template outputs the price variable directly into an HTML attribute, bypassing QloApps' standard output-encoding path. See the AdminRoomTypeGlobalDemand controller and the form template for the vulnerable paths.

Attack Vector

Exploitation is network-based and requires both low privileges on the attacker side and user interaction from the victim. An attacker crafts a request targeting the Additional Facilities form submission endpoint, embedding a JavaScript payload in the price parameter. The attacker then lures an authenticated back-office user into triggering the request, typically via a malicious link or embedded form. When the server returns the validation error page, the payload executes within the administrative origin. Additional technical analysis is available in the VulnCheck advisory and the HackMD write-up.

Detection Methods for CVE-2026-110219

Indicators of Compromise

HTTP POST requests to QloApps back-office endpoints associated with AdminRoomTypeGlobalDemand containing a price parameter with <script>, onerror=, javascript:, or encoded script fragments.
Server access logs showing administrator sessions submitting Additional Facilities form requests originating from external referrers or unexpected URLs.
Browser console errors or Content Security Policy (CSP) violation reports tied to administrator sessions on the hotel reservation module.

Detection Strategies

Inspect web server and application logs for non-numeric values in the price parameter of Additional Facilities form submissions.
Deploy web application firewall (WAF) signatures that flag reflected XSS patterns on back-office QloApps routes.
Correlate administrative session activity with outbound requests to unknown domains after Additional Facilities form submissions.

Monitoring Recommendations

Enable and review CSP reporting on QloApps administrative interfaces to detect script execution anomalies.
Monitor back-office authentication events for session reuse from unexpected IP addresses following form submissions.
Alert on changes to admin-only resources immediately after a validation error response from the hotelreservationsystem module.

How to Mitigate CVE-2026-110219

Immediate Actions Required

Apply the upstream fix tracked in QloApps Pull Request #1809 once merged into a tagged release.
Restrict back-office access to trusted networks or VPN segments to reduce exposure to social-engineering delivery of crafted links.
Educate administrators to avoid clicking untrusted links while authenticated to the QloApps back office.

Patch Information

The fix is proposed in QloApps Pull Request #1809, which adds proper escaping of the price field when it is re-rendered after validation failure. Operators running QloApps 1.7.0 or earlier should track the upstream QloApps repository for a tagged release that incorporates the patch and upgrade promptly.

Workarounds

Deploy a WAF rule that rejects Additional Facilities form submissions where the price parameter contains non-numeric characters.
Enforce a strict Content Security Policy on the QloApps back office that disallows inline script execution.
Limit back-office access to a small set of trusted administrators and require multi-factor authentication to reduce the attack surface for social-engineered requests.

bash

# Example nginx rule to block non-numeric price parameters on the Additional Facilities endpoint
location ~ /index\.php {
    if ($arg_price ~* "[^0-9\.]") {
        return 403;
    }
}