CVE-2026-41467

ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()

View on CVE.org
Published Apr 27, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.

Analysis

AI-generated

Technical impact

A stored cross‑site scripting flaw exists in ProjeQtor’s file upload functions, where the checkValidFileName() routine does not block .html or .htm files. Authenticated attackers can place scripts inside these files and upload them through image or attachment endpoints. Any user who later opens the file URL will have the embedded JavaScript run in their browser, potentially stealing data or hijacking session state.

Affected Systems

The vulnerability affects ProjeQtor versions 7.0 through 12.4.3. All installations running these releases are susceptible, regardless of operating system or deployment environment.

Risk and Exploitability

The CVSS score of 5.1 classifies this as moderately severe. Because the flaw requires authentication and file upload capability, the attack surface is limited to authenticated users. No public exploit code is known, and the vulnerability is not listed in the CISA KEV catalog; its EPSS score is currently unavailable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to ProjeQtor 12.4.4 or later, which removes the flaw in checkValidFileName()
  • If upgrading is not possible, block uploads of files with .html or .htm extensions and reject them before storage
  • Configure the web server to serve uploaded files with safe MIME types and enable content‑type sniffing protection to prevent script execution

Generated by OpenCVE AI on April 28, 2026 at 04:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Projeqtor
Projeqtor projeqtor
Vendors & Products Projeqtor
Projeqtor projeqtor
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.
Title ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jul 14, 2026, 8:00 PM
Reserved
Apr 20, 2026, 4:07 PM

View source JSON

Updated
Apr 27, 2026, 7:15 PM

JSON

Status
Deferred
Published
Apr 27, 2026, 4:16 PM
Modified
Jun 17, 2026, 10:46 AM

View source JSON

No data.

Updated
Apr 28, 2026, 4:30 AM

JSON