CVE-2026-4044: projectsend Delete import-orphans.php realpath path traversal
A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4044?
The severity of CVE-2026-4044 is considered high due to its potential for unauthorized access through path traversal.
How do I fix CVE-2026-4044?
To fix CVE-2026-4044, update your ProjectSend installation to a version later than r1945 where the vulnerability is patched.
What type of vulnerability is CVE-2026-4044?
CVE-2026-4044 is a path traversal vulnerability that allows attackers to manipulate file paths and possibly gain access to sensitive files.
Which versions of ProjectSend are affected by CVE-2026-4044?
ProjectSend versions up to and including r1945 are affected by CVE-2026-4044.
What component is impacted by CVE-2026-4044?
CVE-2026-4044 affects the Delete Handler component of ProjectSend specifically involving the import-orphans.php file.