EUVD-2026-25866Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where authenticated users holding upload permissions can smuggle directory-traversal sequences inside a crafted ZIP archive so that files extract outside the intended plugin directory. By planting a PHP webshell into a web-accessible path, an attacker executes arbitrary code with the web server's privileges. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as actively exploited in the wild, and EPSS is a modest 0.42% (62nd percentile).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Projeqtor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.
Executive ViewAI
ProjeQtor project management software versions 7.0-12.4.3 are vulnerable to remote code execution through the plugin upload feature, allowing authenticated users with upload permissions to execute arbitrary code with web-server privileges. Organizations using ProjeQtor face data compromise and infrastructure risk if upload access is broadly granted or if privilege controls are not enforced.
Within 24 hours, audit ProjeQtor user permissions to identify and revoke plugin-upload access from all non-essential accounts and service identities. Within 7 days, disable the plugin upload feature at the application level if not actively required for operations, implement filesystem integrity monitoring on the plugin directory, and enable detailed logging of all upload attempts. Within 30 days, initiate contact with ProjeQtor vendor to confirm patch release timeline and begin upgrade planning; if no patch is released within 90 days, initiate procurement of an alternative project management platform.
Restrict plugin-upload role to business-critical users only and enforce periodic access reviews. Disable plugin uploads entirely if not operationally required. Implement filesystem monitoring and change detection on the plugin extraction directory. Centralize and alert on all upload activity logs. Apply network segmentation to limit lateral movement from the web server. Upgrade to patched version when vendor releases it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the usern
projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/pri
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' r
projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceE
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to upload HTML or HTM files v
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious H
uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a
Multiple cross-site scripting (XSS) vulnerabilities in ProjeQtOr (formerly Project'Or RIA) before 4.0.0 allow remote att
GitHub PoC
Exploit-DB