CVE-2023-53980 HIGH

CVE-2023-53980: ProjectSend r1605 Remote Code Execution via File Extension Manipulation

Vendor Projectsend
Product projectSend
Weakness CWE-434 · Unrestricted file upload
Published December 22, 2025
Last update March 5, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.

Key dates

02Disclosure timeline

December 22, 2025 CVE published
March 5, 2026 Record updated