CVE-2026-110221: QloApps Reflected XSS Vulnerability

CVE-2026-110221 Overview

CVE-2026-110221 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in QloApps through version 1.7.0. The flaw resides in the AdminHotelFeaturePricesSettings controller, which echoes the feature_price_name and impact_value POST parameters unescaped after server-side validation fails. An attacker can craft a malicious link or auto-submitting form that lures an authenticated back-office user into executing arbitrary JavaScript inside their administrative session. Successful exploitation runs attacker-controlled script in the context of a privileged hotel management user, enabling session abuse, administrative action forgery, and theft of data accessible from the admin panel.

Critical Impact
Authenticated back-office users can be coerced into executing arbitrary JavaScript, exposing administrative sessions and hotel reservation data to hijacking.

Affected Products

QloApps versions through 1.7.0
QloApps hotelreservationsystem module — AdminHotelFeaturePricesSettings controller
QloApps advanced price rule administration form (hotel_feature_prices_settings template)

Discovery Timeline

2026-10-13 - CVE-2026-110221 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110221

Vulnerability Analysis

QloApps is an open-source hotel reservation and property management platform built on the PrestaShop framework. The AdminHotelFeaturePricesSettings controller handles creation and editing of advanced price rules through a back-office form. When server-side validation of the submitted rule fails, the controller re-renders the form and reflects the submitted feature_price_name and impact_value POST values back into the HTML response without proper output encoding.

Because the reflected values are placed directly into the rendered form template, an attacker-supplied payload containing HTML or script tags is interpreted by the browser as markup. The vulnerability requires an authenticated back-office session and user interaction, since the malicious form submission must be delivered to a signed-in administrator. Exploitation grants the attacker script execution within the trusted admin origin, enabling actions such as cookie theft, forced administrative requests, and manipulation of reservation data.

Root Cause

The root cause is missing output encoding in the admin form template. The controller logic at modules/hotelreservationsystem/controllers/admin/AdminHotelFeaturePricesSettings.php passes raw POST input to the Smarty-rendered form template at modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl, which emits the values without HTML escaping. User-controlled input flows into the response as part of the HTML document, which is the classic pattern for reflected XSS described by CWE-79.

Attack Vector

Exploitation is network-based and requires an authenticated administrator with privileges to access the hotel feature prices settings page. The attacker crafts a page that auto-submits a POST request to the vulnerable endpoint containing payloads in feature_price_name or impact_value. When the target administrator visits the attacker-controlled page, the browser submits the request using the active admin session, the server fails validation, and the reflected response executes the attacker's JavaScript inside the admin origin. Refer to the VulnCheck advisory for QloApps reflected XSS for additional technical context.

// No verified public proof-of-concept code is available.
// See the VulnCheck advisory and QloApps source references for details.

Detection Methods for CVE-2026-110221

Indicators of Compromise

POST requests to AdminHotelFeaturePricesSettings containing HTML control characters such as <, >, ", or script tokens in the feature_price_name or impact_value fields.
HTTP referrers pointing to external or unfamiliar domains that redirect administrators to the QloApps back-office endpoint.
Admin session activity originating immediately after a failed validation response rendering reflected input.

Detection Strategies

Inspect web server and application logs for POST bodies to the hotel feature prices endpoint containing encoded or raw script payloads.
Deploy a web application firewall (WAF) rule that flags administrative POSTs where feature_price_name or impact_value contain HTML tag characters.
Correlate authenticated admin requests with anomalous outbound requests from administrator browsers, indicating potential session or cookie exfiltration.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the back-office domain to surface unexpected inline script execution.
Alert on administrative account activity following HTTP 200 responses to validation-failed form submissions.
Review back-office audit logs for unexpected changes to price rules, user accounts, or module configuration.

How to Mitigate CVE-2026-110221

Immediate Actions Required

Restrict back-office access to trusted IP ranges or require VPN access to reduce exposure to lure-based attacks.
Instruct administrators to avoid clicking untrusted links while signed into the QloApps back office and to use isolated browser profiles for admin tasks.
Monitor the QloApps GitHub repository for a security release addressing the reflected XSS in AdminHotelFeaturePricesSettings.

Patch Information

At the time of publication, no fixed version is listed in the NVD record for CVE-2026-110221. The vulnerability is confirmed in QloApps through 1.7.0. Operators should track the official QloApps GitHub repository and the VulnCheck advisory for patch availability and apply the vendor update as soon as it is released.

Workarounds

Apply a reverse-proxy or WAF rule that blocks or sanitizes HTML metacharacters in the feature_price_name and impact_value POST parameters submitted to AdminHotelFeaturePricesSettings.
Add a strict Content Security Policy to the back-office responses that disallows inline scripts and restricts script sources to the admin origin.
Enforce the HttpOnly and SameSite=Strict attributes on the administrator session cookie to limit theft and cross-site submission.
Patch the Smarty template at form.tpl locally to escape reflected values using {$var|escape:'html':'UTF-8'} until the upstream fix is published.

bash

# Example WAF rule (ModSecurity) to block script tags in vulnerable fields
SecRule ARGS:feature_price_name|ARGS:impact_value "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1261102210,phase:2,deny,status:403,log,msg:'CVE-2026-110221 QloApps XSS attempt'"