PT-2026-35442 · Projeqtor · Projeqtor

Noé Susset + 1 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-41463

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjeQtor versions 7.0 through 12.4.3

Description A ZipSlip path traversal issue exists in the plugin upload functionality. Authenticated attackers with upload permissions can write files outside the intended extraction directory by using ZIP archives containing directory traversal sequences. This unvalidated archive extraction allows for the placement of a PHP webshell in a web-accessible directory, leading to remote code execution with the privileges of the web server process. The issue is located in the 'uploadPlugin.php' endpoint.

Recommendations Update to version 12.4.4 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41463

Affected Products

Projeqtor

References · 8

• 🔥 https://gryfman.fr/cves/CVE-2026-41463 · Exploit
• 🔥 https://damiri.fr/en/cves/CVE-2026-41463 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41463 · Security Note
• https://twitter.com/CVEnew/status/2048852151011602779 · Twitter Post
• https://t.me/CVEtracker/51957 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2048827317045108900 · Twitter Post
• https://projeqtor.com · Note
• https://vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php · Note