EUVD-2026-83616

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

Path Traversal

prestashop/prestashop is vulnerable to Path Traversal. The vulnerability exists in the getEmailHTML function at AdminTranslationsController.php due to improper access control in the displayAjaxEmailHTML function which allows an attacker to read any file on the server...