Vulnerabilities CVE-2026-41465

CVE-2026-41465

High

Open

TLP:CLEAR

ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.

Details

CVSS Score: 7.1
EPSS Score ⓘ: 0.54%

42.8th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Apr 27, 2026
Last Modified: Jul 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.