CVE-2026-41465 — ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php
ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against dir…
Published: 2026-04-27 · CVSS: 7.1 · CVSS 4.0
ProjeQtor versions 7.0 through 12.4.3 contain a path traversal vulnerability in the log file viewer at dynamicDialog.php where the logname parameter is not validated against directory traversal sequences before constructing file paths. Authenticated attackers can inject directory traversal sequences ../ into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7