All vulnerabilities
CVE-2026-112003GHSA-pv88-7863-5hwq

ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend ProjectSend
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.7.0Fixed versionCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.

Text from CVE List

Affected versions 1

  • ProjectSendaffected: 2.0.0 before 2.7.0CVE List

References 5