CVE-2019-11378

8.8 highEPSS 3.6%

An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-04-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

projectsend:projectsend

References

http://www.securityfocus.com/bid/108069
https://github.com/projectsend/projectsend/issues/700
http://www.securityfocus.com/bid/108069
https://github.com/projectsend/projectsend/issues/700

Check your stack JSON