Vulnerability · Published Mar 12, 2026 · Assigned by VulDB

CVE-2026-4044projectsend Delete import-orphans.php realpath path traversal

Low 3.8

In plain English

A low-severity path traversal in projectsend. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	projectsend	r1945

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

References

VDB-350656 | projectsend Delete import-orphans.php realpath path traversal vdb-entry, technical-description
VDB-350656 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #769528 | projectsend 35dfd6f08f7d517709c77ee73e57367141107e6b Path Traversal third-party-advisory
https://drive.google.com/file/d/1BOWm9FvhmM90oP91rOWpI4GoWdbI06wg/view?usp=sharing exploit