CVE-2026-41465: ProjeQtor Path Traversal Vulnerability

CVE-2026-41465 Overview

CVE-2026-41465 is a path traversal vulnerability affecting ProjeQtor project management software versions 7.0 through 12.4.3. The vulnerability exists in the log file viewer functionality at dynamicDialog.php, where the logname parameter is not properly validated against directory traversal sequences before constructing file paths. This allows authenticated attackers to inject directory traversal sequences (../) into the logname parameter to read arbitrary .log files accessible to the web server process on the filesystem.

Critical Impact

Authenticated attackers can exploit this path traversal vulnerability to read sensitive log files outside the intended directory, potentially exposing configuration data, system information, and other sensitive details stored in log files accessible to the web server.

Affected Products

• ProjeQtor versions 7.0 through 12.4.3
• Web servers running vulnerable ProjeQtor installations
• Systems with accessible .log files in the web server's filesystem scope

Discovery Timeline

• 2026-04-27 - CVE-2026-41465 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-41465

Vulnerability Analysis

This path traversal vulnerability (CWE-22) stems from insufficient input validation in ProjeQtor's log file viewer component. The dynamicDialog.php endpoint accepts a logname parameter that is used to construct file paths for reading log files. However, the application fails to sanitize or validate this parameter against directory traversal sequences before incorporating it into file system operations.

When an authenticated user submits a request to the log viewer, the application directly concatenates the user-supplied logname value with the base log directory path. Without proper validation, an attacker can craft a malicious request containing ../ sequences to escape the intended log directory and access arbitrary .log files anywhere on the filesystem that the web server process has read permissions for.

The attack requires authentication to the ProjeQtor application, meaning the attacker needs valid credentials or access to an authenticated session. Once authenticated, exploitation is straightforward and can be performed with a simple HTTP request modification.

Root Cause

The root cause of this vulnerability is the absence of input sanitization for the logname parameter in the dynamicDialog.php file. The application constructs file paths by directly appending user input to a base directory path without:

1. Filtering or removing directory traversal sequences (../ or ..\)
2. Canonicalizing the resulting path to verify it remains within the intended directory
3. Implementing allowlist validation for permitted log file names

This design flaw allows attackers to traverse the directory structure and access files outside the designated log directory.

Attack Vector

The attack is network-based and requires low-privilege authentication to the ProjeQtor application. An authenticated attacker crafts a malicious HTTP request to the dynamicDialog.php endpoint with the logname parameter containing directory traversal sequences.

For example, an attacker might manipulate the parameter to include multiple ../ sequences followed by a target path ending in .log, such as system log files or application logs from other services. The web server processes this request and returns the contents of the targeted log file, exposing potentially sensitive information.

The vulnerability's network attack vector with low complexity and no user interaction requirement makes it relatively easy to exploit once authentication is obtained. For detailed technical information about the exploitation mechanism, refer to the VulnCheck advisory.

Detection Methods for CVE-2026-41465

Indicators of Compromise

• HTTP requests to dynamicDialog.php containing ../ sequences in the logname parameter
• Web server access logs showing repeated requests to the log viewer endpoint with unusual or encoded path patterns
• Unexpected access to system log files or log files outside the ProjeQtor log directory
• Authentication logs showing legitimate user accounts accessing log viewer functionality at unusual times or frequencies

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing directory traversal patterns in URL parameters
• Monitor web server access logs for requests to dynamicDialog.php with suspicious logname values including .., %2e%2e, or other encoded traversal sequences
• Deploy file integrity monitoring on sensitive log files to detect unauthorized read access
• Configure intrusion detection systems to alert on path traversal attack signatures targeting ProjeQtor endpoints

Monitoring Recommendations

• Enable detailed logging for the ProjeQtor application to capture all requests to sensitive endpoints including dynamicDialog.php
• Implement real-time alerting for multiple failed or suspicious log file access attempts from the same authenticated session
• Monitor for anomalous data exfiltration patterns that may indicate bulk log file retrieval through the vulnerable endpoint

How to Mitigate CVE-2026-41465

Immediate Actions Required

• Upgrade ProjeQtor to a version newer than 12.4.3 that addresses this vulnerability
• Implement web application firewall rules to block requests containing directory traversal sequences
• Restrict access to the dynamicDialog.php endpoint to only administrative users who require log viewing functionality
• Review and restrict file system permissions for the web server process to minimize the scope of accessible files

Patch Information

Organizations running ProjeQtor versions 7.0 through 12.4.3 should upgrade to the latest patched version as soon as possible. Consult the ProjeQtor official website for the latest security updates and release notes. Additional vulnerability details are available from the VulnCheck advisory.

Workarounds

• Deploy a reverse proxy or WAF in front of ProjeQtor to filter requests containing path traversal patterns before they reach the application
• Temporarily disable or restrict access to the log viewer functionality by modifying server configuration or ProjeQtor access controls
• Implement file system isolation or containerization to limit the scope of files accessible to the web server process
• Monitor and audit all access to the vulnerable endpoint while awaiting patch deployment

# Example: Apache mod_rewrite rule to block path traversal attempts
# Add to .htaccess or virtual host configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
RewriteCond %{QUERY_STRING} (%2e%2e%2f) [NC,OR]
RewriteCond %{QUERY_STRING} (%252e%252e%252f) [NC]
RewriteRule ^dynamicDialog\.php$ - [F,L]