CVE-2026-41465CWE-22

ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php

High · published April 27, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-27T15:10Z
EPSS history
Timeline
  • 27 APR 15:10Z
    ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php
    cvelistv5