CVE-2021-40887

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-11 · updated 2026-06-17
Weakness: CWE-22

Description

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.

Affected products

ProjectSend: r1295

References

https://github.com/projectsend/projectsend/issues/994
https://github.com/projectsend/projectsend/issues/994

Get alerted when CVE-2021-40887 or the next vulnerability affects your stack