ProjeQtor CVE-2026-41467

Exploitation requires a valid authenticated session in ProjeQtor with at least low-privileged user access (CVSS PR:L), meaning anonymous internet attackers cannot exploit this directly. The attacker must have permission to use the image upload or attachment upload endpoint. Exploitation further requires passive user interaction (CVSS UI:P): a second authenticated victim must access the URL of the uploaded file, either by being directed there or by organically navigating to it. The vulnerable function is specifically checkValidFileName(), which is invoked during file upload - the attack fails if that function is patched to block .html and .htm extensions. Exploitation is NOT automatable per SSVC assessment, confirming that chaining the upload with victim delivery requires manual steps. Limiting factors: authentication required for upload, victim must navigate to the file URL, no network-level exploit path exists.

The CVSS 4.0 score of 5.1 (Medium) reflects an accurate mid-tier risk profile. The PR:L metric confirms an authentication barrier - anonymous internet exploitation is not possible, which is the single most important limiting factor here. The UI:P metric indicates a victim must passively access the uploaded file URL, introducing a social engineering or phishing component. The subsequent-system impact (SC:L/SI:L) captures the session-context JavaScript execution in the victim's browser. EPSS at 0.03% (9th percentile) is very low, and SSVC rates exploitation as 'none' and automatable as 'no,' both consistent with the PR:L and UI:P constraints that prevent spray-and-pray attacks. Despite a publicly available POC referenced from damiri.fr and gryfman.fr, the combination of authentication requirement and required victim navigation substantially depresses real-world exploitation probability. The technical impact is partial - session hijacking or credential theft is plausible, but full system compromise is not directly achievable via this vector alone. No CVSS 3.x vector was provided by NVD; the CVSS 4.0 vector is the authoritative source here.

An authenticated ProjeQtor user with access to the file upload functionality crafts an HTML file embedding JavaScript that exfiltrates the victim's session cookie to an attacker-controlled server. The attacker uploads this file via the image or attachment endpoint and then shares the resulting file URL with a privileged target (e.g., a project administrator) through a ProjeQtor message or external channel. When the target clicks the link, their browser renders the HTML file in the application's origin context and executes the script, delivering their session token to the attacker. A public POC is available at damiri.fr and gryfman.fr, lowering the skill bar for exploitation.