CVE-2026-4044
Path Traversal in ProjectSend Delete Handler Enables Remote Exploit
Publication date: 2026-03-12
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| projectsend | projectsend | to r1945 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4044 is a path traversal vulnerability in ProjectSend up to revision r1945, specifically in the Delete Handler component within the file /import-orphans.php.
The vulnerability occurs because the function handling the files[] argument does not properly sanitize or normalize the input, allowing an attacker to manipulate file paths using traversal sequences like ../ to access files outside the intended directory.
This improper handling allows remote attackers, with some level of authentication, to delete arbitrary files on the server by sending specially crafted requests.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to delete arbitrary files on your server that are accessible by the web server process.
Such unauthorized deletion can affect the integrity and availability of your system, potentially removing critical files and disrupting services.
Since the exploit is publicly available and can be executed remotely (though requiring some authentication), it increases the risk of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by identifying the presence of the vulnerable file /import-orphans.php in ProjectSend up to revision r1945 and by monitoring for suspicious POST requests that manipulate the files[] parameter to perform path traversal.'}, {'type': 'paragraph', 'content': 'One detection method is to use Google dorking with the query inurl:import-orphans.php to find potentially vulnerable targets.'}, {'type': 'paragraph', 'content': 'On your system, you can check for POST requests to /import-orphans.php with parameters like action=delete and files[] containing traversal sequences (e.g., ../).'}, {'type': 'list_item', 'content': 'Use web server access logs to search for POST requests with suspicious files[] parameters, for example using grep:'}, {'type': 'list_item', 'content': "grep -i 'import-orphans.php' /var/log/apache2/access.log | grep 'action=delete' | grep 'files[]='"}, {'type': 'list_item', 'content': "Look for traversal patterns in the files[] parameter such as '../' sequences."}, {'type': 'list_item', 'content': 'Use intrusion detection systems (IDS) or web application firewalls (WAF) to alert on path traversal attempts targeting /import-orphans.php.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been reported by the vendor, and the vendor did not respond to early disclosure attempts.
The recommended immediate step is to replace the affected component or product to avoid exploitation.
Additionally, restrict access to /import-orphans.php to trusted administrators only and monitor for suspicious activity targeting this endpoint.
Implement network-level protections such as web application firewalls (WAF) to block path traversal attempts.
If possible, disable or restrict the delete functionality in /import-orphans.php until a secure fix or update is available.