CVE-2026-41463: ProjeQtor Path Traversal Vulnerability

CVE-2026-41463 Overview

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability (CWE-22) in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory. By crafting malicious ZIP archives containing directory traversal sequences (e.g., ../), attackers can escape the designated extraction path and write arbitrary files to web-accessible directories. This vulnerability can be leveraged to deploy PHP webshells, ultimately achieving remote code execution with the privileges of the web server process.

Critical Impact

Authenticated attackers can achieve remote code execution by exploiting unvalidated ZIP archive extraction to write malicious PHP webshells to web-accessible directories, compromising the entire web server.

Affected Products

• ProjeQtor version 7.0 through 12.4.3
• ProjeQtor plugin upload functionality (uploadPlugin.php)
• Web server environments running vulnerable ProjeQtor installations

Discovery Timeline

• 2026-04-27 - CVE-2026-41463 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-41463

Vulnerability Analysis

The ZipSlip vulnerability in ProjeQtor stems from improper handling of file paths during ZIP archive extraction within the plugin upload functionality. When a user with upload permissions submits a plugin as a ZIP archive, the application extracts its contents without properly validating or sanitizing the file paths contained within the archive entries.

An attacker can craft a malicious ZIP archive where filenames include directory traversal sequences such as ../../webroot/shell.php. When the vulnerable extraction routine processes these entries, it concatenates the malicious path with the intended extraction directory, resulting in file writes outside the secure boundary. This allows arbitrary file placement anywhere the web server process has write access.

The exploitation path typically involves uploading a ZIP archive containing a PHP webshell with a traversal-prefixed path, causing the webshell to be written to a publicly accessible web directory. Once deployed, the attacker can execute arbitrary commands through the webshell with the privileges of the web server user (commonly www-data or apache).

Root Cause

The root cause of this vulnerability is the absence of proper path validation during ZIP archive extraction. The application fails to canonicalize extracted file paths and verify they resolve within the intended destination directory before writing files. Specifically, the uploadPlugin.php endpoint does not implement checks to detect or reject path traversal sequences embedded in archive entry names, allowing attackers to break out of the extraction directory.

Attack Vector

The attack leverages the network-accessible plugin upload functionality in ProjeQtor. An authenticated attacker with plugin upload permissions crafts a malicious ZIP archive containing files with directory traversal sequences in their names. Upon upload, the vulnerable extraction logic writes the embedded files to locations outside the intended plugin directory.

The typical exploitation workflow involves:

1. Crafting a ZIP archive with an entry named ../../../var/www/html/shell.php containing a PHP webshell
2. Uploading the malicious archive through the plugin upload interface
3. The extraction routine writes the webshell to the web root directory
4. Accessing the webshell via HTTP to execute arbitrary commands on the server

This attack requires authenticated access with upload permissions but does not require user interaction beyond the initial upload action.

Detection Methods for CVE-2026-41463

Indicators of Compromise

• Unexpected PHP files appearing in web-accessible directories outside the plugin upload path
• Web server access logs showing requests to newly created PHP files in unusual locations
• ZIP archives uploaded to ProjeQtor containing ../ sequences in archived filenames
• Unusual process spawning from the web server user account (e.g., www-data executing shell commands)

Detection Strategies

• Monitor file creation events in web root directories for unexpected PHP files not created through normal deployment processes
• Implement web application firewall (WAF) rules to inspect uploaded ZIP archives for path traversal sequences
• Configure file integrity monitoring (FIM) on critical web directories to detect unauthorized file additions
• Review ProjeQtor application logs for plugin upload activity, especially from accounts with elevated permissions

Monitoring Recommendations

• Enable detailed logging for the plugin upload functionality and archive extraction operations
• Set up alerts for file writes outside the designated plugin extraction directory
• Monitor for webshell indicators such as PHP files containing common webshell functions (system(), exec(), passthru(), shell_exec())
• Implement network monitoring to detect command-and-control traffic patterns associated with webshell activity

How to Mitigate CVE-2026-41463

Immediate Actions Required

• Upgrade ProjeQtor to a patched version that addresses CVE-2026-41463 (version 12.4.4 or later when available)
• Restrict plugin upload permissions to only trusted administrative accounts
• Review existing uploaded plugins and web directories for signs of compromise
• Consider temporarily disabling the plugin upload functionality until patching is complete

Patch Information

Consult the ProjeQtor Official Site for the latest security updates addressing this vulnerability. Additional technical details are available from the VulnCheck Projeqtor Advisory. Further information can also be found at the Damiri CVE-2026-41463 Details page.

Workarounds

• Implement strict access controls to limit plugin upload permissions to essential personnel only
• Deploy a web application firewall with rules to block uploads containing path traversal sequences in archived file names
• Apply file system restrictions to prevent the web server process from writing to directories outside the application scope
• Use security modules like mod_security for Apache or equivalent protections to detect and block exploitation attempts

# Example: Restrict write permissions on web directories
chmod 755 /var/www/html
chown root:root /var/www/html
# Ensure web server cannot write to web root
# Only allow writes to specific upload directories with proper validation