CVE-2021-40886: Path Traversal

Published Oct 11, 2021

Updated

Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value 2 for chunks parameter to bypass fileName sanitization.

Affected Software

1 affected component

ProjectSend ProjectSend=r1295

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Projectsend to a version that resolves this vulnerability.
Fixed in r1295

Event History

Oct 11, 2021

CVE Published

via MITRE·10:24 AM

Data Sourced

via MITRE·10:24 AM

Description

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-40886?

CVE-2021-40886 is a directory traversal vulnerability in Projectsend version r1295.

How does CVE-2021-40886 affect Projectsend?

CVE-2021-40886 allows a user with the Uploader role to bypass filename sanitization by adding the value '2' for the 'chunks' parameter.

Which version of Projectsend is affected by CVE-2021-40886?

Projectsend version r1295 is affected by CVE-2021-40886.

What is the severity of CVE-2021-40886?

CVE-2021-40886 has a severity rating of medium (6.5 out of 10).

Is there a fix for CVE-2021-40886?

There is currently no fix available for CVE-2021-40886. It is recommended to upgrade to a patched version when one becomes available.