Executive Summary

CVE-2026-4044 is a path traversal vulnerability in ProjectSend up to revision r1945, specifically in the Delete Handler component within the file /import-orphans.php.

The vulnerability occurs because the function handling the files[] argument does not properly sanitize or normalize the input, allowing an attacker to manipulate file paths using traversal sequences like ../ to access files outside the intended directory.

This improper handling allows remote attackers, with some level of authentication, to delete arbitrary files on the server by sending specially crafted requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to delete arbitrary files on your server that are accessible by the web server process.

Such unauthorized deletion can affect the integrity and availability of your system, potentially removing critical files and disrupting services.

Since the exploit is publicly available and can be executed remotely (though requiring some authentication), it increases the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying the presence of the vulnerable file /import-orphans.php in ProjectSend up to revision r1945 and by monitoring for suspicious POST requests that manipulate the files[] parameter to perform path traversal.'}, {'type': 'paragraph', 'content': 'One detection method is to use Google dorking with the query inurl:import-orphans.php to find potentially vulnerable targets.'}, {'type': 'paragraph', 'content': 'On your system, you can check for POST requests to /import-orphans.php with parameters like action=delete and files[] containing traversal sequences (e.g., ../).'}, {'type': 'list_item', 'content': 'Use web server access logs to search for POST requests with suspicious files[] parameters, for example using grep:'}, {'type': 'list_item', 'content': "grep -i 'import-orphans.php' /var/log/apache2/access.log | grep 'action=delete' | grep 'files[]='"}, {'type': 'list_item', 'content': "Look for traversal patterns in the files[] parameter such as '../' sequences."}, {'type': 'list_item', 'content': 'Use intrusion detection systems (IDS) or web application firewalls (WAF) to alert on path traversal attempts targeting /import-orphans.php.'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

No known countermeasures or mitigations have been reported by the vendor, and the vendor did not respond to early disclosure attempts.

The recommended immediate step is to replace the affected component or product to avoid exploitation.

Additionally, restrict access to /import-orphans.php to trusted administrators only and monitor for suspicious activity targeting this endpoint.

Implement network-level protections such as web application firewalls (WAF) to block path traversal attempts.

If possible, disable or restrict the delete functionality in /import-orphans.php until a secure fix or update is available.

Useful 0 Not Useful 0