Cyber Posture

CVE-2026-41463

HighPublic PoC

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 64.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers…

more

can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Validates ZIP archive paths and contents during plugin upload to block directory traversal sequences from writing files outside the intended extraction directory.

AC-3 Access Enforcement good match
prevent

Enforces access control policies to restrict file write operations to only the approved plugin directory during archive extraction.

SI-2 Flaw Remediation good match
prevent

Identifies, reports, and patches the specific ZipSlip path traversal flaw in ProjeQtor's plugin upload functionality.

Security SummaryAI

CVE-2026-41463, published on 2026-04-27, is a ZipSlip path traversal vulnerability (CWE-22) in the plugin upload functionality of ProjeQtor versions 7.0 through 12.4.3. The flaw stems from unvalidated archive extraction, enabling attackers to write files outside the intended extraction directory using crafted ZIP archives containing directory traversal sequences. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H).

Authenticated attackers with upload permissions can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By uploading a malicious ZIP archive, they can place a PHP webshell in a web-accessible directory, leading to remote code execution under the privileges of the web server process.

Advisories detailing mitigations and patches are available from sources including https://damiri.fr/en/cves/CVE-2026-41463, https://gryfman.fr/cves/CVE-2026-41463, https://www.projeqtor.com, and https://www.vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

ZipSlip path traversal in plugin upload enables exploitation of public-facing web application (T1190) to write arbitrary files like PHP webshells (T1100) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References