File and Path Handling

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potent…CVE-2019-11378Projectsend · 3.6% likely

   CWE-22

2. Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP…CVE-2021-40887Projectsend · 2.4% likely

   CWE-22

3. ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.CVE-2016-10733Projectsend · 2.1% likely

   CWE-22

4. Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.CVE-2021-40886Projectsend · 1.4% likely

   CWE-22

5. ProjectSend r1605 Remote Code Execution via File Extension ManipulationCVE-2023-53980ProjectSend · CVSS 9.8 · 0.9% likely

   CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.