Which versions of ProjeQtor are affected by CVE-2026-41465?

ProjeQtor versions 7.0 through 12.4.3 contain a file disclosure vulnerability that could allow attackers with legitimate application access to extract sensitive log files from affected servers.

Is there a public PoC exploit available for CVE-2026-41465?

Yes, a public proof-of-concept exploit is available for CVE-2026-41465. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-41465?

Within 24 hours: Inventory all ProjeQtor instances and confirm versions in use, particularly 7.0-12.4.3; review access logs for suspicious requests to dynamicDialog.php. Within 7 days: Deploy Web Application Firewall rules to block path traversal sequences (../) in the logname parameter; restrict network access to dynamicDialog.php to authorized administrators only; implement input validation to reject ../ sequences. Within 30 days: Monitor ProjeQtor vendor advisory channels for patches targeting version 12.4.4 or later; develop and test an upgrade plan for all affected instances.

ProjeQtor CVE-2026-41465

Q: What is the CVSS score of CVE-2026-41465?

CVE-2026-41465 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25868 HIGH

Path Traversal (CWE-22)

2026-04-27 VulnCheck

Path Traversal PHP Projeqtor

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint (AV:N/AC:L) requires a valid low-privileged account (PR:L, UI:N); arbitrary .log read gives high confidentiality (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:55 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Apr 27, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 15:30 euvd

EUVD-2026-25868

CVE Published

Apr 27, 2026 - 15:10 nvd

HIGH 7.1

DescriptionCVE.org

ProjeQtor versions 7.0 through 12.4.3 contains a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.

AnalysisAI

Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on the filesystem by injecting ../ sequences into the logname parameter of the dynamicDialog.php log viewer. Reported by VulnCheck with publicly available exploit code; EPSS is low (0.20%, 42th percentile) and it is not in CISA KEV, so no public exploit identified as actively exploited. The flaw is limited to files readable by the web server process and to .log-named targets, capping direct impact to information disclosure.

Technical ContextAI

ProjeQtor is a PHP-based open-source web application for IT/enterprise project management (tasks, tickets, resources, planning). The vulnerable component is the server-side log viewer endpoint dynamicDialog.php, which builds a filesystem path from the user-supplied logname parameter without canonicalizing or validating it against directory traversal. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): because ../ sequences are not stripped or rejected, the constructed path escapes the intended log directory. The single affected-product CPE is cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:*, confirming the vendor/product scope. The tags PHP and Path Traversal align with the root cause.

RemediationAI

Upgrade to a ProjeQtor release later than 12.4.3 that contains the fix; no vendor-released patched version is independently confirmed in the provided data, so treat this as 'no vendor-released patched version independently confirmed at time of analysis' and verify the fixed build directly with the vendor at https://www.projeqtor.com and the advisory at https://www.vulncheck.com/advisories/projeqtor-path-traversal-via-dynamicdialog-php. Until a confirmed fixed version is applied, restrict reachability of the dynamicDialog.php log-viewer endpoint at the web server or WAF layer (for example block or filter requests whose logname parameter contains ../ , encoded traversal like %2e%2e%2f, or absolute paths), and limit the endpoint to administrative users only - noting this may break legitimate log-viewing for lower-privileged operators. Additionally tighten filesystem permissions so the web server process cannot read sensitive files outside its log directory, and audit ProjeQtor accounts to remove unnecessary low-privileged users, since exploitation requires authentication.