PT-2026-35444 · Projeqtor · Projeqtor

Noé Susset + 1 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-41465

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjeQtor versions 7.0 through 12.4.3

Description A path traversal issue exists in the log file viewer. Authenticated attackers can inject directory traversal sequences into the logname parameter at the 'dynamicDialog.php' endpoint to read arbitrary .log files accessible to the web server process on the filesystem. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update to version 12.4.4 or later. As a temporary workaround, restrict access to the 'dynamicDialog.php' endpoint or avoid using the logname parameter until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41465

Affected Products

Projeqtor

References · 8

• 🔥 https://damiri.fr/en/cves/CVE-2026-41465 · Exploit
• 🔥 https://gryfman.fr/cves/CVE-2026-41465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41465 · Security Note
• https://vulncheck.com/advisories/projeqtor-path-traversal-via-dynamicdialog-php · Note
• https://twitter.com/CVEnew/status/2048852148348170364 · Twitter Post
• https://projeqtor.com · Note
• https://t.me/CVEtracker/51959 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2048832436604203099 · Twitter Post