Executive brief
ProjectSend, a self-hosted file-sharing platform, contains a security flaw that allows users to inject malicious scripts into file names. When an administrator or another user views the dashboard or file list, these scripts can execute automatically in their browser. This could allow an attacker to hijack administrative sessions, steal sensitive information, or perform unauthorized actions on the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in ProjectSend r1295 within the 'files-edit.php' component. The root cause is improper neutralization of user-provided input in the 'name' parameter (file title field). An authenticated attacker with any role can upload a file and then modify its name to include a JavaScript payload. This payload is stored in the database and subsequently executed when a victim, such as a System Administrator, views the Dashboard or file management pages. While the vendor has released newer versions (e.g., r2029), users on r1295 should upgrade to mitigate this risk.
Affected products
- ProjectSend ProjectSend r1295
Timeline
- 2021-08-30: disclosed: Exploit code published on Exploit-DB
- 2026-05-10: advisory: CVE published/updated via VulnCheck