CVE-2026-41463

HighPublic PoC

Published: 27 April 2026

Published

27 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0047 64.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41463 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Validates ZIP archive paths and contents during plugin upload to block directory traversal sequences from writing files outside the intended extraction directory.

AC-3 Access Enforcement good match

prevent

Enforces access control policies to restrict file write operations to only the approved plugin directory during archive extraction.

SI-2 Flaw Remediation good match

prevent

Identifies, reports, and patches the specific ZipSlip path traversal flaw in ProjeQtor's plugin upload functionality.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

ZipSlip path traversal in plugin upload enables exploitation of public-facing web application (T1190) to write arbitrary files like PHP webshells (T1100) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by crafting ZIP archives with directory traversal sequences. Attackers…

can exploit unvalidated archive extraction to write a PHP webshell to a web-accessible directory and achieve remote code execution with the privileges of the web server process.

Deeper analysisAI

CVE-2026-41463, published on 2026-04-27, is a ZipSlip path traversal vulnerability (CWE-22) in the plugin upload functionality of ProjeQtor versions 7.0 through 12.4.3. The flaw stems from unvalidated archive extraction, enabling attackers to write files outside the intended extraction directory using crafted ZIP archives containing directory traversal sequences. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H).

Authenticated attackers with upload permissions can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By uploading a malicious ZIP archive, they can place a PHP webshell in a web-accessible directory, leading to remote code execution under the privileges of the web server process.

Advisories detailing mitigations and patches are available from sources including https://damiri.fr/en/cves/CVE-2026-41463, https://gryfman.fr/cves/CVE-2026-41463, https://www.projeqtor.com, and https://www.vulncheck.com/advisories/projeqtor-zipslip-path-traversal-via-uploadplugin-php.