Is CVE-2026-93988 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-93988?

CVE-2026-93988 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-93988

Description

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.