PT-2026-1879 · Qloapps · Qloapps

Published 2026-01-08 · Updated 2026-01-09 · CVE-2025-67325

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QloApps versions 1.7.0 and earlier

Description An unrestricted file upload issue exists in the hotel review feature. This allows remote, unauthenticated attackers to execute code on the system. The issue involves the ability to upload arbitrary files, potentially leading to remote code execution.

Recommendations Update QloApps to a version later than 1.7.0.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-67325

Affected Products

Qloapps

References · 8

• 🔥 https://github.com/mr7s3d0/CVE-2025-67325 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67325 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67325 · Vendor Advisory
• https://github.com/Qloapps/QloApps · Note
• https://twitter.com/CveFindCom/status/2009349204083130829 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009349502965088476 · Twitter Post
• https://twitter.com/CVEnew/status/2009462377188872410 · Twitter Post
• https://t.me/CVEtracker/41758 · Telegram Post