Vulnerability · Published Apr 27, 2026 · Assigned by VulnCheck

CVE-2026-41465ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php

Medium 6.5

In plain English

A medium-severity path traversal in ProjeQtor from ProjeQtor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.

Affected products (as reported)

Vendor	Product	Versions
ProjeQtor	ProjeQtor	7.0 – through 12.4.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://damiri.fr/en/cves/CVE-2026-41465 technical-description, exploit
https://gryfman.fr/cves/CVE-2026-41465 technical-description, exploit
https://www.projeqtor.com product
https://www.vulncheck.com/advisories/projeqtor-path-traversal-via-dynamicdialog-php third-party-advisory