CVE-2026-41463 Details
Description
ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.
A ZipSlip path traversal vulnerability has been identified in ProjeQtor versions 7.0 prior to 12.4.4. This vulnerability exists in the plugin upload functionality, where authenticated attackers with upload permissions can craft ZIP archives containing directory traversal sequences. When these archives are uploaded, the application extracts them without proper validation, allowing attackers to write files outside the intended directory. This exploitation can lead to remote code execution by placing a PHP web shell in a directory accessible by the web server.
Users are advised to update to ProjeQtor version 12.4.4 or later. Additionally, the extraction logic should be modified to validate file paths before writing them to disk, ensuring that archives are extracted safely and that uploaded content is stored outside of the web root when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://damiri.fr/en/cves/CVE-2026-41463 | [email protected] | Broken Link |
| https://gryfman.fr/cves/CVE-2026-41463 | [email protected] | Technical Description |
| https://www.projeqtor.com | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjeQtOr | >= 7.0, <= 12.4.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | New CVE Received | [email protected] |