Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly…
Priority MEDIUM 62CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
Why it matters now
EPSS 0.4334 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:* | 100 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:102:*:*:*:*:*:*:* | 102 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:105:*:*:*:*:*:*:* | 105 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:110:*:*:*:*:*:*:* | 110 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:155:*:*:*:*:*:*:* | 155 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:156:*:*:*:*:*:*:* | 156 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:157:*:*:*:*:*:*:* | 157 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:161:*:*:*:*:*:*:* | 161 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:180:*:*:*:*:*:*:* | 180 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:335:*:*:*:*:*:*:* | 335 | Vulnerable | ProjectSend |
- cpe:2.3:a:projectsend:projectsend:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:105:*:*:*:*:*:*:* Versions 105 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:110:*:*:*:*:*:*:* Versions 110 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:155:*:*:*:*:*:*:* Versions 155 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:156:*:*:*:*:*:*:* Versions 156 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:157:*:*:*:*:*:*:* Versions 157 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:161:*:*:*:*:*:*:* Versions 161 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:180:*:*:*:*:*:*:* Versions 180 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:335:*:*:*:*:*:*:* Versions 335 Vulnerable ·ProjectSend
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectsend:projectsend:375:*:*:*:*:*:*:* | 375 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:405:*:*:*:*:*:*:* | 405 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:412:*:*:*:*:*:*:* | 412 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:514:*:*:*:*:*:*:* | 514 | Vulnerable | ProjectSend |
| cpe:2.3:a:projectsend:projectsend:561:*:*:*:*:*:*:* | 561 | Vulnerable | ProjectSend |
- cpe:2.3:a:projectsend:projectsend:375:*:*:*:*:*:*:* Versions 375 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:405:*:*:*:*:*:*:* Versions 405 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:412:*:*:*:*:*:*:* Versions 412 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:514:*:*:*:*:*:*:* Versions 514 Vulnerable ·ProjectSend
- cpe:2.3:a:projectsend:projectsend:561:*:*:*:*:*:*:* Versions 561 Vulnerable ·ProjectSend
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9567
- 2026-10-03 Alias added: GHSA-9wrg-v9p9-p326
References
More Projectsend vulnerabilities
- TI-2024-10826 ProjectSend Unauthenticated Configuration Modification KEVCVSS 3.1CRITICAL 9.8
- TI-2023-30263 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVSS 4.0HIGH 8.7
- TI-2023-30213 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVSS 4.0HIGH 7.1
- TI-2023-30188 ProjectSend r1605 CSV Injection via User Account Export Functionality CVSS 4.0MEDIUM 6.2
- TI-2017-14167 ProjectSend information disclosure CVSS 3.1MEDIUM 5.7
- TI-2023-00574 Cross-site Scripting (XSS) - Stored in projectsend/projectsend CVSS 3.1MEDIUM 4.8
Sources
- CVE-2014-9567 · CVE Program
- CVE-2014-9567 · NVD
- FIRST EPSS
- GHSA-9wrg-v9p9-p326 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences