CVE-2026-75496 — Webkul QloApps improper file upload validation
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated at…
Published: 2026-08-25 · CVSS: 8.6 · CVSS 4.0
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7