Executive brief
ProjeQtor, an open-source project management software, contains a security flaw in its log file viewer. An authenticated user can bypass directory restrictions to view sensitive system or application log files that they should not have access to. This could lead to the exposure of internal system configurations, user data, or other confidential information stored in log files.
Technical details
A path traversal vulnerability exists in ProjeQtor versions 7.0 through 12.4.3 within the dynamicDialog.php component. The logname parameter fails to properly sanitize directory traversal sequences (e.g., '../') before constructing file paths for the log viewer. An authenticated attacker with low privileges can exploit this by injecting traversal sequences to read arbitrary files on the server's filesystem, provided the files have a .log extension. The vulnerability is reachable over the network and requires no user interaction. The issue is reportedly addressed in version 12.4.4.
Affected products
- ProjeQtor ProjeQtor 7.0 through 12.4.3
Timeline
- 2026-04-24: disclosed: Researcher disclosure by Yassine Damiri and Noé Susset
- 2026-04-27: advisory: NVD and VulnCheck publication