Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-13 | 1 | Disclosure1 |
| 2026-03-30 | 1 | General1 |
New CVEs assigned ! Check writups at http://0xnayel.com CVE-2026-4044: https://0xnayel.com/publications/CVE-2026-4044 CVE-2026-4045 https://0xnayel.com/publications/CVE-2026-4045
Post summary
The text announces two new CVE identifiers and points to external writeups, but supplies no technical, exploit, or mitigation details.
CVE-2026-4044 A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing … https://www.cve.org/CVERecord?id=CVE-2026-4044
Post summary
The entry reports that CVE-2026-4044 was identified in projectSend up to revision r1945, affecting the realpath function in import-orphans.php of the Delete Handler component, without additional details on exploitation, patches, or proof-of-concept.