CVE-2026-25558 Details

A stored cross-site scripting vulnerability has been identified in QloApps versions through 1.7.0. This issue resides in the admin file manager, where authenticated administrators can upload malicious SVG files. These crafted files can include JavaScript event handlers, such as 'onload', which, when viewed by other users, execute arbitrary scripts in their browsers. This vulnerability exploits the fact that SVG files are accepted and later served in a way that allows script execution.

It is recommended to disallow SVG uploads in the admin file manager unless absolutely necessary. If SVG support is required, sanitize uploaded SVG files with a robust SVG sanitizer that removes script-capable elements and event-handler attributes. Additionally, serve user-uploaded SVG files with safe headers and/or from an isolated origin when possible, enforce a strict Content Security Policy for uploaded content, and validate both file extension and actual content type, treating SVG as active content rather than a standard image format.