EUVD-2026-25870Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated upload (PR:L), victim must access URL (UI:R), scope changes as JS executes in victim's browser same-origin context (S:C).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.
AnalysisAI
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to upload HTML or HTM files via the image upload or attachment endpoints, bypassing the defective checkValidFileName() filter, and achieve arbitrary JavaScript execution in any victim's browser who subsequently accesses the uploaded file URL. The vulnerability affects a wide version range spanning five major releases. A publicly available proof-of-concept exists, though SSVC assessment and EPSS of 0.03% (9th percentile) indicate no confirmed real-world exploitation at time of analysis. No actively exploited status per CISA KEV.
Technical ContextAI
ProjeQtor is an open-source project management web application (CPE: cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant triggered through the file upload surface. The checkValidFileName() function, responsible for validating uploaded file extensions, fails to include .html and .htm in its blocklist, allowing these browser-executable file types to be stored on the server. Unlike reflected XSS, the payload persists in the application's storage layer and is served at a stable URL, meaning a single upload can compromise multiple victims over time. The attack vector is the web application's own file-serving mechanism - the browser treats the stored HTML file as a first-party document and executes embedded scripts with full same-origin context.
RemediationAI
Upgrade ProjeQtor to a version beyond 12.4.3 once the vendor publishes a patched release - no confirmed fixed version number was available in the referenced data at time of analysis; monitor https://www.projeqtor.com for release notes. As a compensating control, administrators can configure the web server (Apache/nginx) to serve files from the upload directory with a Content-Disposition: attachment header, forcing downloads rather than inline browser rendering, which prevents JavaScript execution regardless of file type. Adding a Content-Security-Policy header with script-src 'self' on file-serving routes would also block execution of inline scripts in uploaded HTML files. Restricting the upload directory at the web server level to deny direct browser access to .html and .htm extensions (via Deny rules or MIME type enforcement) is a targeted and low-side-effect mitigation. Restricting file upload permissions to trusted user roles within the application reduces the attacker population.
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the usern
projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/pri
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where aut
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' r
projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceE
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious H
uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a
Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote att
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today