CVE-2026-41463
Published: 27 April 2026
Summary
CVE-2026-41463 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-41463, published on 2026-04-27, is a ZipSlip path traversal vulnerability (CWE-22) in the plugin upload functionality of ProjeQtor versions 7.0 through 12.4.3. The flaw stems from unvalidated archive extraction, enabling attackers to write files outside the intended extraction directory using crafted ZIP archives containing directory traversal sequences. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H).
Authenticated attackers with upload permissions can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By uploading a malicious ZIP archive, they can place a PHP webshell in a web-accessible directory, leading to remote code execution under the privileges of the web server process.
Advisories detailing mitigations and patches are available from sources including https://damiri.fr/en/cves/CVE-2026-41463, https://gryfman.fr/cves/CVE-2026-41463, https://www.projeqtor.com, and https://www.vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25866
Vulnerability details
ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers…
more
can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
ZipSlip path traversal in plugin upload enables exploitation of public-facing web application (T1190) to write arbitrary files like PHP webshells (T1100) for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates ZIP archive paths and contents during plugin upload to block directory traversal sequences from writing files outside the intended extraction directory.
Enforces access control policies to restrict file write operations to only the approved plugin directory during archive extraction.
Identifies, reports, and patches the specific ZipSlip path traversal flaw in ProjeQtor's plugin upload functionality.