CVE-2026-41467CWE-79

ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()

Medium · published April 27, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00298 · 21.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-27T15:11Z
EPSS history
Timeline
  • 27 APR 15:11Z
    ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()
    cvelistv5