CVE-2021-40884: ProjectSend

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.

Affected products

• ProjectSend ProjectSend: version r1295 only

Published 2021-10-11. Last modified 2026-06-17.