CVE-2026-41466 Details
Description
ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText() function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers can inject malicious payloads that bypass the filter using alternative syntax such as img tags with event handlers, which are stored and executed in the browsers of users viewing the affected content.
A stored cross-site scripting vulnerability has been identified in ProjeQtOr versions 7.0 prior to 12.4.4. The issue arises in the checkValidHtmlText() function within Security.php, where user input is not properly sanitized. The application attempts to filter out certain HTML patterns but fails to encode or clean the content before displaying it. This allows attackers to inject malicious payloads that bypass the filtering, using alternative syntaxes such as image tags with event handlers. The injected scripts are stored and executed in the browsers of users who view the affected content.
Users are advised to update to ProjeQtOr version 12.4.4 or later. For applications that need to allow some HTML tags, a proper HTML sanitizer library, such as HTML Purifier, should be used. Additionally, implementing a strict Content Security Policy can provide an extra layer of protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://damiri.fr/en/cves/CVE-2026-41466 | [email protected] | Broken Link |
| https://gryfman.fr/cves/CVE-2026-41466 | [email protected] | Technical Analysis |
| https://www.projeqtor.com | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/projeqtor-stored-xss-via-checkvalidhtmltext | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjeQtOr | >= 7.0, <= 12.4.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | New CVE Received | [email protected] |