CVE-2026-41463CWE-22

ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php

High · published April 27, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
75.8
In the wild
Unconfirmed
What it is

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01612 · 75.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-27T15:09Z
EPSS history
Timeline
  • 27 APR 15:09Z
    ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php
    cvelistv5