High severity8.8OSV Advisory· Published Apr 20, 2019· Updated Jun 17, 2026
CVE-2019-11378
CVE-2019-11378
Description
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3r1053, r559, r753, …+ 2 more
- (no CPE)range: r1053, r559, r753, …
- (no CPE)range: <=r1053
- cpe:2.3:a:projectsend:projectsend:r1053:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
2- github.com/projectsend/projectsend/issues/700nvdExploitThird Party Advisory
- www.securityfocus.com/bid/108069nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.