CVE-2026-75496: Webkul QloApps File Upload RCE Vulnerability

CVE-2026-75496 Overview

Webkul QloApps contains an unrestricted file upload vulnerability that allows authenticated administrators to upload executable files to publicly accessible directories. The application fails to validate file extensions or MIME types before writing uploads to disk. An attacker who obtains administrative credentials can upload server-side scripts and trigger remote code execution by requesting the file through the web server. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type and was addressed in commit 153ec1c.

Critical Impact
Authenticated administrators can achieve remote code execution on the underlying web server hosting QloApps.

Affected Products

Webkul QloApps (hotel reservation and booking platform)
QloApps versions prior to commit 153ec1c
Deployments accepting file uploads through the administrative interface

Discovery Timeline

2026-08-25 - CVE-2026-75496 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75496

Vulnerability Analysis

QloApps exposes upload functionality in the administrative interface that writes user-supplied files directly to a directory served by the web server. The upload handler does not enforce an allowlist of permitted extensions and does not verify the MIME type reported by the client against the actual file contents. An attacker with administrator access can therefore upload a PHP file, request it over HTTP, and execute arbitrary code with the privileges of the web server process.

The vulnerability requires high privileges to exploit, since only authenticated administrators can reach the vulnerable upload endpoints. However, admin accounts on public-facing hotel booking installations are frequent targets of credential stuffing, phishing, and reused-password attacks. Once an attacker escalates through the web application into the operating system, they can pivot to reservation databases, payment processing components, and other tenants on the same host.

Root Cause

The root cause is missing server-side validation on the upload pathway. The code moves uploaded files to a publicly accessible directory without confirming that the extension is on an allowed list (for example, .jpg, .png, .pdf) and without inspecting file magic bytes to confirm the declared type. The fix is applied in the QloApps commit 153ec1c.

Attack Vector

Exploitation requires a network-reachable QloApps instance and valid administrative credentials. The attacker authenticates to the admin console, uses the vulnerable upload feature to submit a file with an executable server-side extension such as .php or .phtml, and then issues an HTTP request for the uploaded file. The web server interprets the file as code and executes it, returning attacker output or granting an interactive webshell. No user interaction is required beyond the attacker's own actions.

Detailed technical context is available in the CISA CSAF document VA-26-237-01 and the CVE-2026-75496 record.

Detection Methods for CVE-2026-75496

Indicators of Compromise

Files with executable extensions such as .php, .phtml, .phar, or .jsp appearing in QloApps upload directories that normally hold images or documents.
Unexpected outbound network connections initiated by the web server process shortly after admin activity.
New or modified administrator accounts preceding upload events in application audit logs.
Web server access logs showing GET requests directly to files under upload paths with non-image extensions.

Detection Strategies

Inspect QloApps upload directories for files whose extensions are outside the expected media allowlist.
Correlate administrative session activity with subsequent HTTP requests targeting the same uploaded filenames.
Alert on web server child processes such as sh, bash, cmd.exe, powershell.exe, or nc spawning from the PHP or web worker process tree.
Deploy file integrity monitoring on the QloApps webroot to flag creation of executable content.

Monitoring Recommendations

Forward web server access logs and QloApps application logs to a central analytics platform for retrospective hunting.
Track failed and successful admin authentication events, especially from new geolocations or IP ranges.
Monitor outbound connections from the hosting server to unfamiliar IP addresses and domains.

How to Mitigate CVE-2026-75496

Immediate Actions Required

Update QloApps to a build that includes commit 153ec1c or later.
Rotate credentials for all administrator accounts and enforce multi-factor authentication on the admin console.
Audit upload directories for unexpected executable files and remove any that are not legitimate.
Review web server, application, and database logs for signs of prior exploitation and preserve evidence if activity is found.

Patch Information

The upstream fix is delivered in the QloApps pull request 1801 commit 153ec1c. Operators should pull the patched revision, redeploy the application, and validate that upload endpoints reject files with disallowed extensions and mismatched MIME types.

Workarounds

Restrict access to the QloApps administrative interface using IP allowlists, VPN, or reverse proxy authentication until the patch is applied.
Configure the web server to refuse execution of scripts within upload directories, for example by adding a location block that disables PHP handlers.
Enforce strict server-side extension allowlists at a web application firewall in front of QloApps.
Remove write permissions from the upload directory for the account running the web server on paths that must never contain executable content.

bash

# Nginx: disable script execution within QloApps upload directories
location ~ ^/(img|upload|modules/.*/uploads)/.*\.(php|phtml|phar|pl|py|jsp|cgi)$ {
    deny all;
    return 403;
}

# Apache .htaccess placed in the upload directory
<FilesMatch "\.(php|phtml|phar|pl|py|jsp|cgi)$">
    Require all denied
</FilesMatch>
Options -ExecCGI
AddHandler cgi-script .php .phtml .phar