ProjeQtor CVE-2026-41465

Requires a valid authenticated ProjeQtor account (CVSS PR:L) and network access to the dynamicDialog.php log-viewer endpoint; no user interaction is needed (UI:N). The attacker must supply ../ traversal sequences in the logname parameter. Exploitation is limited to files with a .log extension that are readable by the web server process, which constrains the attacker to log data rather than arbitrary source code or configuration files, and it applies to ProjeQtor versions 7.0 through 12.4.3. The authentication requirement and the .log-only restriction are the primary limiting factors on real-world impact.

Signals are internally consistent and point to a real but bounded issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H, VI:N, VA:N) indicates a network-reachable, low-complexity attack that requires valid low-privileged authentication and yields high confidentiality impact with no integrity or availability impact - matching the description's authenticated arbitrary .log file read. SSVC corroborates this: Exploitation=poc (not active), Automatable=no, Technical Impact=partial. EPSS is low at 0.20% (42th percentile), and the CVE is not in CISA KEV, so despite a public POC there is no evidence of widespread or active exploitation - consistent with a targeted, authentication-gated disclosure bug rather than a wormable RCE. The main caveat is the exploitation constraint: the description limits reads to .log files, which meaningfully reduces the value of the primary path unless an attacker can influence log content/filenames. Overall this is a moderate-priority patch item, elevated where ProjeQtor is internet-exposed or where low-privileged accounts are broadly provisioned.

An attacker with any valid low-privileged ProjeQtor account sends a crafted request to dynamicDialog.php setting the logname parameter to a value such as ../../../../path/to/target.log, causing the server to return the contents of a .log file outside the intended directory. Publicly available exploit code (referenced at damiri.fr and gryfman.fr) demonstrates the technique, enabling disclosure of any .log file readable by the web server process, such as application, framework, or system logs that may contain sensitive data.