A path traversal vulnerability in ProjeQtor allows authenticated attackers to perform remote code execution by uploading malicious ZIP archives.

The application fails to properly validate ZIP archive contents during the plugin upload process, leading to a ZipSlip vulnerability (CWE-22). An authenticated user with upload permissions can craft a malicious archive to write files to arbitrary locations, enabling the deployment of a PHP webshell.

The ability to achieve remote code execution grants an attacker full control over the web server process. This poses a severe risk of data exfiltration, lateral movement within the network, and complete system compromise. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized access and potential service disruption.

Immediate Action: Upgrade ProjeQtor to version 12.4.4 or later, which contains the necessary security fixes to remediate the ZipSlip path traversal vulnerability.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting plugin upload endpoints and monitor for the creation of unexpected files within the web root directory.

Compensating Controls: Restrict access to the plugin upload functionality to only trusted administrative accounts and deploy a Web Application Firewall (WAF) configured to inspect and block ZIP archives containing directory traversal sequences.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-ups provided by Damiri and Gryfman.

The risk associated with this vulnerability is significant, as it allows for trivial remote code execution once an attacker has authenticated access to the plugin management interface. Administrators should prioritize patching to version 12.4.4 immediately to eliminate the underlying flaw. If an immediate update is not feasible, restrict upload permissions strictly to minimize the attack surface until the remediation can be applied.