Vulnerability · Published Apr 27, 2026 · Assigned by VulnCheck

CVE-2026-41463ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php

High 8.8

In plain English

A high-severity path traversal in ProjeQtor from ProjeQtor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.

Affected products (as reported)

Vendor	Product	Versions
ProjeQtor	ProjeQtor	7.0 – through 12.4.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://damiri.fr/en/cves/CVE-2026-41463 technical-description, exploit
https://gryfman.fr/cves/CVE-2026-41463 technical-description, exploit
https://www.projeqtor.com product
https://www.vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php third-party-advisory