CVE-2026-89268: QloApps XSS Vulnerability

CVE-2026-89268 Overview

CVE-2026-89268 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting QloApps through version 1.7.0. The flaw resides in the back-office list helper template, which renders filter POST parameters into HTML value attributes without escaping. An attacker can craft a malicious POST request targeting a list controller and coerce an authenticated administrator into submitting it. The payload then executes arbitrary JavaScript in the victim's session context, enabling data theft and unauthorized administrative actions.

Critical Impact
Successful exploitation runs attacker-controlled JavaScript in an authenticated administrator's browser, allowing extraction of back-office data and execution of privileged actions on behalf of the victim.

Affected Products

QloApps versions up to and including 1.7.0
QloApps back-office administration interface
Impacted template: admin/themes/default/template/helpers/list/list_header.tpl

Discovery Timeline

2026-09-12 - CVE-2026-89268 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89268

Vulnerability Analysis

The vulnerability exists in the Smarty template list_header.tpl, which builds filter input fields for back-office list views. When rendering range and other filter input types, the template writes $smarty.post[$field_name] values directly into HTML value attributes without applying HTML escaping. Any script or event-handler payload injected through the filter POST parameter is reflected verbatim into the DOM.

Because the sink is inside an attribute, an attacker can break out of the attribute using quote characters and inject arbitrary handlers or <script> tags. Execution occurs in the context of the authenticated administrator loading the list page, granting the attacker access to session cookies, CSRF tokens, and any function reachable from the back-office UI.

Root Cause

The root cause is missing output encoding on user-controlled POST data in the list helper template. The vulnerable code uses {$smarty.post[$field_name][0]} directly, without the escape:'html':'UTF-8' modifier that Smarty provides for this purpose. This is a classic reflected XSS pattern driven by trust in POST-supplied filter values.

Attack Vector

Exploitation requires an authenticated back-office user to submit a crafted POST request to a list controller (for example, via a CSRF-style form hosted on an attacker-controlled page or through a phishing link). Once submitted, the malicious filter value is reflected into the rendered list header, triggering JavaScript execution in the administrator's authenticated session.

text

// Vulnerable template (pre-patch) — admin/themes/default/template/helpers/list/list_header.tpl
<input type="text" class="filter form-control" name="{$field_name}[0]"
       placeholder="{l s='From'}"
       value="{if isset($smarty.post[$field_name][0]) && $smarty.post[$field_name][0]}{$smarty.post[$field_name][0]}{elseif isset($params.value.0)}{$params.value.0}{/if}">

// Patched template (post-fix) — HTML escaping applied via Smarty modifier
<input type="text" class="filter form-control" name="{$field_name}[0]"
       placeholder="{l s='From'}"
       value="{if isset($smarty.post[$field_name][0]) && $smarty.post[$field_name][0]}{$smarty.post[$field_name][0]|escape:'html':'UTF-8'}{elseif isset($params.value.0)}{$params.value.0}{/if}">

Source: QloApps Commit 153ec1c

Detection Methods for CVE-2026-89268

Indicators of Compromise

POST requests to back-office list controllers containing filter parameters named <listId>Filter_<key> with values including <script, onerror=, onload=, or javascript:.
HTTP referer values pointing to unexpected external domains preceding a back-office list view request.
Unusual back-office actions (user creation, permission changes, data exports) originating from an administrator session shortly after a list page load.

Detection Strategies

Inspect web server and application logs for POST requests to /admin* endpoints where filter parameters contain HTML metacharacters (<, >, ") or common XSS keywords.
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies for script tags and JavaScript event handlers targeting QloApps list controllers.
Correlate administrator session activity with prior inbound links or emails to identify social-engineering delivery of crafted requests.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions in the back-office.
Alert on anomalous administrator behavior, such as bulk data reads or configuration changes outside normal working hours.
Monitor for outbound requests from administrator browsers to unfamiliar domains that may indicate cookie or token exfiltration.

How to Mitigate CVE-2026-89268

Immediate Actions Required

Upgrade QloApps to a version that includes commit 153ec1c8567798bd99155098ecc0a340e38f25bf or later, which applies HTML escaping in list_header.tpl.
Restrict back-office access to trusted IP ranges or through a VPN to reduce exposure to unauthenticated attacker-hosted forms.
Rotate administrator credentials and invalidate active sessions if suspicious filter POST activity is observed in logs.

Patch Information

The fix is provided in QloApps Pull Request #1801 and merged via commit 153ec1c. The patch adds |escape:'html':'UTF-8' to $smarty.post values rendered into filter input attributes. Additional details are available in the VulnCheck Advisory on QloApps.

Workarounds

Apply the upstream template change manually to admin/themes/default/template/helpers/list/list_header.tpl if an immediate upgrade is not feasible.
Deploy a WAF rule that blocks POST requests to back-office list controllers containing <, >, or on\w+= patterns in filter parameters.
Enforce a strict Content Security Policy on back-office responses to prevent execution of inline scripts injected via reflected payloads.

bash

# Example ModSecurity rule to block script payloads in QloApps back-office filter parameters
SecRule REQUEST_URI "@beginsWith /admin" \
    "chain,phase:2,deny,status:403,id:1026089268,msg:'CVE-2026-89268 QloApps XSS filter payload blocked'"
  SecRule ARGS_NAMES "@rx Filter_" \
    "chain"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"