Note: The description of this vulnerability has been updated. The core issue is a directory traversal flaw in ProjeQtor’s log file viewer (dynamicDialog.php) that allows an authenticated user to supply a logname parameter containing ../ sequences. The application does not validate this input before constructing the file path, enabling the attacker to read arbitrary .log files accessible to the web server process. The impact is unauthorized disclosure of potentially sensitive information stored in those log files, such as credentials, configuration, or debug data.

All ProjeQtor installations from version 7.0 up to 12.4.3, inclusive, are affected because the path traversal vulnerability resides in the dynamicDialog.php component of the ProjeQtor:ProjeQtor product. No later versions (12.4.4 and above) contain the fix.

Based on the updated description, exploitation requires an attacker to have valid authentication to the ProjeQtor application. After authentication, the attacker can craft requests to dynamicDialog.php with directory traversal payloads to read arbitrary log files that are readable by the web server process. The vulnerability scores 7.1 on the CVSS scale, indicating moderate to high severity. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog. The attack vector is via the web interface, leveraging the logname request parameter, and the exploitation is straightforward in environments where log files are readable by the web server process.