Medium severity5.4NVD Advisory· Published Apr 27, 2026· Updated Apr 27, 2026

CVE-2026-41467

Description

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Projeqtor/Projeqtorllm-fuzzy
Range: >=7.0, <=12.4.3

Patches

Vulnerability mechanics

References

damiri.fr/en/cves/CVE-2026-41467nvd
gryfman.fr/cves/CVE-2026-41467nvd
www.projeqtor.comnvd
www.vulncheck.com/advisories/projeqtor-stored-xss-via-checkvalidfilenamenvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000