CVE-2023-53930 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

What is CVE-2023-53930?

CVE-2023-53930 is a high-severity missing authorization vulnerability in projectSend, published on 17 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

Weakness: CWE-639

Which versions are affected by CVE-2023-53930?

It affects 1 product.

Products include Projectsend Projectsend.

How do I fix CVE-2023-53930?

No fix has been published for CVE-2023-53930 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-53930 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53930 exists.

Other vulnerabilities in projectSend

• CVE-2024-11680 ProjectSend Improper Authentication Exploited Critical 9.8
• CVE-2021-40887 Path traversal in n/a Critical 9.8
• CVE-2016-10731 SQL injection in n/a Critical 9.8
• CVE-2016-10732 Auth bypass in n/a Critical 9.8
• CVE-2016-10733 Path traversal in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gc6r-xc3x-9vvg.