CVE-2023-53980 | ProjectSend r1605 contains a remote code execution vulnerabi… | CVSS 9.8 CRITICAL

Description

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.

Metadata

CVE ID: CVE-2023-53980
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-20 16:31 UTC
Published: 2025-12-22 21:35 UTC
Last updated: 2026-03-05 12:03 UTC
Primary CWE: CWE-434
Unrestricted Upload of File with Dangerous Type
Vendor / Product: ProjectSend / projectSend
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ProjectSend	projectSend	—	r1605

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	Unrestricted Upload of File with Dangerous Type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-51238 https://www.exploit-db.com/exploits/51238
Official Product Homepage https://www.projectsend.org/
VulnCheck Advisory: ProjectSend r1605 Remote Code Execution via File Extension Manipulation https://www.vulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulation