Critical severity · published Dec 22, 2025
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
projectSend · ProjectSend
r1605 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53980
Exploit
https://www.exploit-db.com/exploits/51238
Product
https://www.projectsend.org/
Exploit
https://www.vulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulation
More from projectSend
9.8
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string
9.8
CVE-2016-10732
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or…