CVE-2021-40887: ProjectSend

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.

Affected products

Published 2021-10-11. Last modified 2026-06-17.