CVE-2025-67325

QloApps versions 1.7.0 and earlier are vulnerable to unrestricted file upload within the hotel review feature, specifically at the /module/qlohotelreview/default endpoint. The root cause is a lack of file extension validation, allowing uploaded files to be executed directly by the server without ...