CVE-2026-41467

MEDIUM

ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()

Title source: cna
STIX 2.1

Description

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.

References (4)

Core 4
Core References
Exploit technical-description exploit
https://damiri.fr/en/cves/CVE-2026-41467
Exploit technical-description exploit
https://gryfman.fr/cves/CVE-2026-41467
Product product
https://www.projeqtor.com

Scores

CVSS v3 5.4
EPSS 0.0018
EPSS Percentile 7.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
ProjeQtor/ProjeQtor 12.4.4
ProjeQtor/ProjeQtor 7.0 - 12.4.3
Published Apr 27, 2026
Tracked Since Apr 27, 2026