CVE-2026-41466

Root

Cause The stored cross-site scripting vulnerability resides in the checkValidHtmlText() function in Security.php. Instead of properly sanitizing user input, the function employs regex checks for patterns like ` and a limited set of event attributes, but returns the original unsanitized string without output encoding [2][3]. This allows attackers to bypass the filter using alternative syntax such as ` [2].

Exploitation

An attacker with low authentication privileges can inject malicious content, for example in search fields or comments [2]. The payload is stored and later executed when other users view the affected page, requiring only that a victim loads the malicious content [2][3].

Impact

Successful exploitation enables arbitrary JavaScript execution in the victim's browser, potentially leading to session hijacking, unauthorized actions, or redirection to malicious sites [2][3]. The CVSS v3 score (5.4) reflects the medium severity and changed scope [3].

Mitigation

The vulnerability affects ProjeQtor versions 7.0 through 12.4.3. Users should upgrade to version 12.4.4 or later, which contains a fix [3].