CVE-2026-41465 Details
Description
ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.
A path traversal vulnerability has been identified in ProjeQtor versions 7.0 prior to 12.4.4. The issue resides in the log file viewer, specifically within the dynamicDialog.php file. The vulnerability arises because the logname parameter does not properly validate against directory traversal sequences before creating file paths. This flaw allows authenticated attackers to inject traversal sequences to access arbitrary .log files on the filesystem that are reachable by the web server process.
The application should be updated to version 12.4.4 or later, where this vulnerability has been addressed. Additionally, the log viewer functionality should be modified to prevent arbitrary path inputs, allowing only predefined log names that do not include traversal sequences.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://damiri.fr/en/cves/CVE-2026-41465 | [email protected] | AdvisoryBroken Link |
| https://gryfman.fr/cves/CVE-2026-41465 | [email protected] | Technical Description |
| https://www.projeqtor.com | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/projeqtor-path-traversal-via-dynamicdialog-php | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjeQtOr | >= 7.0, <= 12.4.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |