CVE-2026-4044

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Performing a manipulation of the argument files[] results in path traversal. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-404469.8Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This CVE-2026-404477.5Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115a CVE-2026-404485.3Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung O CVE-2026-404496.6Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source O CVE-2026-40453.7A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipu CVE-2026-404506.6Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption f CVE-2026-404515.1DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to e CVE-2026-404527.5Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-CVE-2026-404539.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandE CVE-2026-404547.5Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock dese CVE-2026-404558.6An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insuffi CVE-2026-404568.6An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passe