CVE-2021-40887

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2021-10-11

Last modified

2024-08-04

Weaknesses

CWE-22

Affected products

• Projectsend (Projectsend)

References

• https://github.com/projectsend/projectsend/issues/994