CVE-2026-41465
MEDIUMProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php
Title source: cnaDescription
ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.
References (4)
Core 4
Core References
Exploit technical-description
exploit
https://damiri.fr/en/cves/CVE-2026-41465
Exploit technical-description
exploit
https://gryfman.fr/cves/CVE-2026-41465
Product product
https://www.projeqtor.com
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/projeqtor-path-traversal-via-dynamicdialog-php
Scores
CVSS v3
6.5
EPSS
0.0054
EPSS Percentile
41.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
ProjeQtor/ProjeQtor
12.4.4
ProjeQtor/ProjeQtor
7.0 - 12.4.3
Published
Apr 27, 2026
Tracked Since
Apr 27, 2026