CVE-2026-75496: CWE-434 Unrestricted Upload of File with Dangerous Type in Webkul QloApps
Description
Webkul QloApps contains a vulnerability where it does not properly validate uploaded file extensions or MIME types before placing files in a publicly accessible directory. This flaw allows a remote, authenticated attacker with administrative privileges to upload executable files, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.2, indicating high severity. A fix has been implemented in commit 153ec1c, but no explicit vendor advisory or patch release version is provided.
CVSS v3.1
Score 7.2high
Affected software
Webkul
QloApps
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75496 describes an unrestricted file upload vulnerability in Webkul QloApps. The application fails to validate file extensions or MIME types on uploaded files before moving them to a directory accessible via the web. This enables a remote attacker with admin privileges to upload executable files, which can be executed remotely, resulting in remote code execution. The vulnerability is classified under CWE-434. Although a fix exists in the form of a specific commit (153ec1c), no official patch or version information is provided in the available data.
Potential Impact
An attacker with administrative access can upload malicious executable files to the server, which can then be executed remotely. This can lead to full system compromise, including confidentiality, integrity, and availability impacts as reflected by the CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Mitigation Recommendations
A fix has been implemented in commit 153ec1c. However, no official patch release or vendor advisory is provided in the data. Users should apply the fix from the referenced commit or check Webkul's official channels for an updated version containing this fix. Until patched, restrict administrative access and avoid uploading untrusted files.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-08-17T20:16:01.457Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8dcc10acd9273b4979f624
Added to database: 08/25/2026, 17:08:32 UTC
Last enriched: 09/10/2026, 03:07:40 UTC
Last updated: 10/07/2026, 18:48:23 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.