Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck
CVE-2023-53980ProjectSend r1605 Remote Code Execution via File Extension Manipulation
Critical 9.8
In plain English
A critical-severity unrestricted file upload in projectSend from ProjectSend. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 38.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ProjectSend | projectSend | r1605 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51238 exploit
- Official Product Homepage product
- VulnCheck Advisory: ProjectSend r1605 Remote Code Execution via File Extension Manipulation third-party-advisory