ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path‑traversal flaw in the uploadPlugin.php handler. An attacker who can authenticate and has upload permissions can craft a specially‑structured ZIP archive that extracts files outside the intended directory. This allows writing a PHP webshell into a publicly accessible location and executing code with the privileges of the web server process, compromising confidentiality, integrity, and availability of the system.

The vulnerability affects ProjeQtor 7.0 up to 12.4.3 across all supported platforms. The issue is limited to installations that enable the uploadPlugin.php functionality and allow authenticated users to upload files.

With a CVSS score of 8.7 the flaw is considered high severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly documented exploit at this time. The likely attack vector is an authenticated user with upload rights, who can evade server checks by uploading a malicious ZIP file that extracts files out of bounds. If successful, the attacker gains remote code execution as the web server user.