CVE-2019-11378

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-20 · updated 2026-06-17
Weakness: CWE-22

Description

An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.

Affected products

ProjectSend: r1053

References

http://www.securityfocus.com/bid/108069
https://github.com/projectsend/projectsend/issues/700
http://www.securityfocus.com/bid/108069
https://github.com/projectsend/projectsend/issues/700

Get alerted when CVE-2019-11378 or the next vulnerability affects your stack