ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to… (CVE-2026-112003)

The vulnerability in ProjectSend affects versions from 2.0.0 before 2.7.0 and involves improper path validation in the OrphanFileScanner::isOrphan() method. Staff users with the import_orphans permission can submit path aliases such as ./ to the orphans import or delete endpoints. This manipulation enables them to bypass the delete_others_files permission and either delete or adopt files belonging to other users. The issue is classified under CWE-180 (Improper Handling of File Pathnames).

An attacker with limited staff permissions (import_orphans) can escalate their ability to delete or take ownership of files they should not control. This leads to unauthorized file deletion or adoption, impacting data integrity and availability. The CVSS score of 5.9 (medium severity) reflects the moderate complexity of the attack and the requirement for some privileges.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the import_orphans permission to trusted staff only and monitor usage of orphan file import and delete endpoints closely.