Webkul QloApps fails to validate the file extension or MIME type of uploaded files before moving them to a publicly accessible directory. The vulnerability allows a remote attacker who has authenticated administrative privileges to upload executable files that the application subsequently serves from a web-accessible location. By doing so, the attacker can execute arbitrary code on the web server, compromising confidentiality, integrity, and availability of the entire application and potentially the underlying operating system. The weakness corresponds to CWE-434, Insecure File Upload, and is classified with a high CVSS score of 8.6.

The affected product is Webkul QloApps. Any deployment running a version prior to the fixed commit 153ec1c is vulnerable. No specific version range has been listed, but the fix is applied in the commit referenced, which releases a patched build for the product.

With a CVSS score of 8.6 the vulnerability is considered high severity. The EPSS score is not available, but the absence of a KEV listing suggests that public exploits are not yet reported or known. The attack requires that the attacker have authenticated administrative privileges, enabling file uploads through the web interface. Once an attacker uploads a malicious executable to the public directory, a subsequent request to that file will trigger remote code execution. The impact is severe due to the remote nature of the attack and the privileged context in which it occurs.