A vulnerability in Projectsend up to revision r1945 allows an attacker to perform a path traversal attack by manipulating the files[] parameter in import-orphans.php. This flaw exploits the realpath function, enabling the attacker to read arbitrary files on the server. Remote exploitation is possible and the exploit is publicly available, potentially compromising confidentiality of sensitive files.

The affected product is Projectsend, any version up to revision r1945. No specific sub-modules are listed; the path traversal occurs in the Delete Handler component's import-orphans.php script.

The CVSS score for this issue is 5.1, indicating a moderate severity. The EPSS score is below 1%, suggesting low probability of exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The exposure is via a web request, so an attacker only needs remote access to the vulnerable endpoint to manipulate the files[] argument and trigger the path traversal. There is no official patch or workaround provided by the vendor, so the risk remains until a newer release or fix is applied.