# CVE-2021-47947: ProjectSend stored XSS in files-edit.php

Source: https://junglewise.ai/threats/cve-2021-47947-projectsend-stored-xss-in-files-edit-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2021-47947 · Severity: medium · CVSS 6.4 · Published 2026-05-10

ProjectSend, a self-hosted file-sharing platform, contains a security flaw that allows users to inject malicious scripts into file names. When an administrator or another user views the dashboard or file list, these scripts can execute automatically in their browser. This could allow an attacker to hijack administrative sessions, steal sensitive information, or perform unauthorized actions on the platform.

Technologies: [ProjectSend](https://junglewise.ai/threats/technologies/projectsend). Vendors: [ProjectSend](https://junglewise.ai/threats/vendors/projectsend).

## Quick answers

**Is CVE-2021-47947 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-47947 being exploited in the wild.

**How severe is CVE-2021-47947?** Medium severity, with a CVSS score of 6.4, published 10 May 2026.

**Which products and versions are affected?** ProjectSend r1295.

**Is there a fix for CVE-2021-47947?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-47947 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-47947?** Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in ProjectSend r1295 within the 'files-edit.php' component. The root cause is improper neutralization of user-provided input in the 'name' parameter (file title field). An authenticated attacker with any role can upload a file and then modify its name to include a JavaScript payload. This payload is stored in the database and subsequently executed when a victim, such as a System Administrator, views the Dashboard or file management pages. While the vendor has released newer versions (e.g., r2029), users on r1295 should upgrade to mitigate this risk.

## Affected products

- ProjectSend ProjectSend r1295

## Timeline

- 2021-08-30: disclosed: Exploit code published on Exploit-DB
- 2026-05-10: advisory: CVE published/updated via VulnCheck

## References

- [https://www.exploit-db.com/exploits/50240](https://www.exploit-db.com/exploits/50240)
- [https://www.projectsend.org/](https://www.projectsend.org/)
- [https://www.projectsend.org/download/387/](https://www.projectsend.org/download/387/)
- [https://www.vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php](https://www.vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php)

## Related threats

- [ProjectSend incomplete authorization in FileVersions::link()](https://junglewise.ai/threats/cve-2026-116136-projectsend-2-0-0-through-2-7-1-contains-an-incomplete)
- [ProjectSend path validation flaw in OrphanFileScanner](https://junglewise.ai/threats/cve-2026-112003-projectsend-2-0-0-before-2-7-0-contains-a-path-validation-flaw)
- [ProjectSend password change authentication bypass in social-provisioned accounts](https://junglewise.ai/threats/cve-2026-112002-projectsend-2-5-0-before-2-7-0-contains-an-unverified-password)
- [ProjectSend authorization bypass via API token privilege escalation](https://junglewise.ai/threats/cve-2026-112001-projectsend-2-0-0-before-2-7-0-contains-an-incorrect)
- [ProjectSend CSRF in file upload endpoint](https://junglewise.ai/threats/cve-2026-5624-projectsend-csrf-in-file-upload-endpoint)