CVE-2026-75496: Webkul Qloapps

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

Affected products

• Webkul Qloapps: before 153ec1c (fixed in 153ec1c)

Published 2026-08-25. Last modified 2026-08-26.