← Back to CVE List

CVE-2019-11378

Published: 2019-04-20T15:29Z
Last Modified: 2024-11-21T04:20Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt