CVE-2025-67325

Critical · 9.8

CVSS

9.8

EPSS

0.9%

Published

Jan 8, 2026

CISA due date

—

The record

Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.

Affected packages

Ecosystem	Package	Introduced	Fixed