CVE-2026-92234: QloApps Hotel Reservation XSS Vulnerability

CVE-2026-92234 Overview

CVE-2026-92234 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in QloApps through version 1.7.0, an open-source hotel reservation and property management platform. The flaw resides in the Hotel Reservation System feature management page, where the back-office controller reflects unescaped child_features parameter values into validation error messages. An authenticated back-office user who follows a crafted link executes attacker-supplied JavaScript within their administrative session context. The issue was patched in commit 54a3b30 via pull request #1796, which wraps the reflected input with Tools::safeOutput().

Critical Impact
Successful exploitation allows script execution in an authenticated administrator's browser, enabling session abuse, back-office action forgery, or exfiltration of hotel reservation data visible to the targeted admin.

Affected Products

QloApps Hotel Reservation System through version 1.7.0
AdminHotelfeaturesController.php in the hotelreservationsystem module
Back-office administrative interface handling child feature creation and validation

Discovery Timeline

2026-09-15 - CVE-2026-92234 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92234

Vulnerability Analysis

The vulnerability is a reflected XSS in the QloApps back-office feature management workflow. When an administrator submits a form to create or edit hotel features, AdminHotelfeaturesController.php validates each child feature name using Validate::isGenericName(). If validation fails, the controller constructs an error message that concatenates the invalid input directly into the response.

Because the raw child_features (and per-language child_features_<id_lang>) values are appended to the error string without HTML encoding, an attacker can supply a payload containing HTML or JavaScript. The payload renders in the administrator's browser when the error page is displayed, executing under the origin of the back-office application. The impact is limited to users who already hold back-office privileges and who interact with a crafted link, but the reflected script inherits the full authenticated session context.

Root Cause

The root cause is missing output encoding on user-controlled input before inclusion in an HTML response. The errors array is populated with a concatenated string that mixes a translated prefix with the raw submitted value. Neither the controller nor the downstream template escapes the invalid value, so any HTML metacharacters passed in child_features reach the browser intact.

Attack Vector

An attacker must authenticate to the back office (or coerce an authenticated administrator to follow a crafted URL or submit a prepared form). The request targets the hotel features controller with a child_features value that both fails isGenericName() validation and contains executable script content. When QloApps re-renders the form with the validation error, the injected payload executes in the administrator's session.

php

// Patch: modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php
                         $this->errors[] = $this->l('Child features name is required at least in ').
                         $objDefaultLanguage['name'];
                     } elseif (!Validate::isGenericName($childftr)) {
-                        $this->errors[] = $this->l('Child features name is invalid : ').$childftr;
+                        $this->errors[] = $this->l('Child features name is invalid : ').Tools::safeOutput($childftr);
                     } else {
                         foreach ($languages as $lang) {
                             if ($childFtrLang = Tools::getValue('child_features_'.$lang['id_lang'])) {
                                 if (!Validate::isGenericName($childFtrLang[$kChild])) {
                                     $this->errors[] = $this->l('Invalid child feature name in ').$lang['name'].
-                                    ' : '.$childFtrLang[$kChild];
+                                    ' : '.Tools::safeOutput($childFtrLang[$kChild]);
                                 }
                             }
                         }

Source: QloApps Commit #54a3b30. The fix routes both the primary and per-language child feature values through Tools::safeOutput(), which performs HTML entity encoding before the string is placed in the error message.

Detection Methods for CVE-2026-92234

Indicators of Compromise

Back-office POST or GET requests to the hotel features admin controller containing child_features or child_features_<id_lang> parameters with HTML tags such as <script, <img, onerror=, or javascript:.
Referer headers on back-office requests pointing to untrusted external domains, suggesting an administrator followed a crafted link.
Web server access logs showing repeated validation failures for feature submissions from a single session, correlated with outbound requests to unfamiliar hosts.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect child_features* parameters on requests to the QloApps hotelreservationsystem admin routes and block payloads containing HTML or JavaScript syntax.
Review the rendered back-office error messages for unencoded angle brackets; a properly patched instance will emit < and > entities.
Hunt in browser or endpoint telemetry for administrator sessions where the back-office origin loads or executes unexpected inline scripts.

Monitoring Recommendations

Enable and centralize QloApps and reverse-proxy access logs, and alert on 4xx or 5xx responses from the hotel features controller that include suspicious parameter content.
Monitor for anomalous administrative actions immediately following a feature validation error, which may indicate session-riding through the injected script.
Track outbound HTTP requests from administrator workstations to domains not associated with normal QloApps operations.

How to Mitigate CVE-2026-92234

Immediate Actions Required

Upgrade QloApps to a release that includes commit 54a3b30 (merged via Pull Request #1796) or apply the patch manually to AdminHotelfeaturesController.php.
Restrict back-office access to trusted networks or VPN ranges to reduce exposure to link-based delivery of crafted URLs.
Instruct administrators to avoid following untrusted links to the QloApps back office and to log out of active sessions when not in use.

Patch Information

The vendor fix wraps reflected child_features values with Tools::safeOutput() in modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php. See the QloApps Commit #54a3b30, the associated QloApps Pull Request #1796, and the Vulncheck Advisory for QloApps for reference.

Workarounds

Enforce a strict Content Security Policy (CSP) on the QloApps back office that disallows inline scripts and restricts script sources to the application origin.
Configure a WAF signature to reject requests to the hotel features admin endpoint when child_features* parameters contain <, >, or javascript: sequences.
Require re-authentication for sensitive back-office actions to reduce the value of a hijacked administrative session.

bash

# Example nginx location block adding a restrictive CSP header for the QloApps admin path
location ^~ /admin-qloapps/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    proxy_pass http://qloapps_backend;
}