Which versions of PHP are affected by CVE-2026-41463?

ProjeQtor project management software versions 7.0-12.4.3 are vulnerable to remote code execution through the plugin upload feature, allowing authenticated users with upload permissions to execute…

Is there a public PoC exploit available for CVE-2026-41463?

Yes, a public proof-of-concept exploit is available for CVE-2026-41463. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-41463?

Within 24 hours, audit ProjeQtor user permissions to identify and revoke plugin-upload access from all non-essential accounts and service identities. Within 7 days, disable the plugin upload feature at the application level if not actively required for operations, implement filesystem integrity monitoring on the plugin directory, and enable detailed logging of all upload attempts. Within 30 days, initiate contact with ProjeQtor vendor to confirm patch release timeline and begin upgrade planning; if no patch is released within 90 days, initiate procurement of an alternative project management platform.

PHP CVE-2026-41463

Q: What is the CVSS score of CVE-2026-41463?

CVE-2026-41463 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-25866 HIGH

Path Traversal (CWE-22)

2026-04-27 VulnCheck

PHP RCE Path Traversal Projeqtor

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:56 vuln.today

PoC Detected

Apr 27, 2026 - 18:36 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 16:22 NVD

8.8 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 15:30 euvd

EUVD-2026-25866

CVE Published

Apr 27, 2026 - 15:09 nvd

HIGH 8.7

DescriptionCVE.org

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.

AnalysisAI

Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where authenticated users holding upload permissions can smuggle directory-traversal sequences inside a crafted ZIP archive so that files extract outside the intended plugin directory. By planting a PHP webshell into a web-accessible path, an attacker executes arbitrary code with the web server's privileges. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as actively exploited in the wild, and EPSS is a modest 0.42% (62nd percentile).