Threats affecting pkg:github/ProjectSend

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.

ProjectSend versions 2.5.0 up to but not including 2.7.0 have a vulnerability in the password update functionality that allows sessions of social-provisioned accounts to set local passwords without verifying the current password. An attacker with a stolen session cookie can exploit this to create a persistent local password, enroll a second factor, and maintain control over the account.

ProjectSend versions 2.0.0 through 2.6.x contain an incorrect authorization vulnerability allowing API token holders with limited permissions to escalate privileges. Specifically, attackers with tokens limited to manage_users and edit_users can change the token owner's password, disable two-factor authentication, and sign in with full owner permissions. This flaw is fixed in version 2.7.0.

CVE-2026-5624 is a cross-site request forgery (CSRF) vulnerability affecting ProjectSend version r2002, specifically in the file upload.php. This flaw allows an attacker to remotely initiate unauthorized actions by exploiting the CSRF weakness. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. A patch is available in version r2029, identified by commit 2c0d25824ab571b6c219ac1a188ad9350149661b, which resolves the issue. Users of the affected version are advised to upgrade to the fixed release to mitigate the risk.

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component.

ProjectSend has an improper authentication vulnerability that allows remote, unauthenticated attackers to modify application configuration via crafted HTTP requests to options.php. Exploitation enables attackers to create accounts, upload webshells, and embed malicious JavaScript, leading to potential full compromise. This vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided yet.