ProjectSend Path Validation Bypass via Orphan File Import and Delete
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
ProjectSend from 2.0.0 before 2.7.0 contains a path validation flaw (CWE-180) in its orphan file scanner, where validation happens before the path is canonicalized. An attacker with staff access and the import_orphans permission can submit ./ path aliases to the orphans import or delete endpoints. This makes tracked files of other owners look like orphans, so the attacker can delete or adopt them while bypassing the delete_others_files permission. The exploit is not listed in CISA KEV, and CISA's assessment notes a proof of concept exists.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ProjectSend | ProjectSend | 2.0.0 to before 2.7.0 | 2.7.0 | Patch available | CNA |
- ProjectSend VendorProjectSend Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* | — | — | ProjectSend |
- cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* Versions — — ·ProjectSend
Remediation
Upgrade ProjectSend to version 2.7.0 or later, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA ProjectSend (ProjectSend) Fixed in 2.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
ProjectSend 2.7.0
3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-76153 ProjectSend users API flaw lets token holders take over accountsPriority HIGH 72
- TI-2026-76154 Unverified password change in ProjectSend lets attackers take over accountsPriority LOW 35
Timeline
- 2026-10-18 Threatist record created from CVE-2026-112003
- 2026-10-18 Alias added: GHSA-f5fh-phpc-hrv4
- 2026-10-19 Priority changed: MEDIUM → LOW
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: LOW → MEDIUM
References
More ProjectSend vulnerabilities
- TI-2024-10826 ProjectSend Unauthenticated Configuration Modification KEVCVSS 3.1CRITICAL 9.8
- TI-2023-30263 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVSS 4.0HIGH 8.7
- TI-2026-76153 ProjectSend users API flaw lets token holders take over accounts CVSS 4.0HIGH 8.6
- TI-2023-30213 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVSS 4.0HIGH 7.1
- TI-2014-07764 Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly… CVSS 2.0HIGH 7.5
- TI-2023-30188 ProjectSend r1605 CSV Injection via User Account Export Functionality CVSS 4.0MEDIUM 6.2
Sources
- CVE-2026-112003 · CVE Program
- CVE-2026-112003 · NVD
- FIRST EPSS
- GHSA-f5fh-phpc-hrv4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences