CVE-2026-5624
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Cross-Site Request Forgery (CSRF) vulnerability in ProjectSend r2002 in upload.php. The attack can be performed remotely. An exploit is publicly available.
Risk Assessment
An attacker can force an authenticated user to perform unwanted actions, such as uploading files or changing settings.
Recommendation
Update ProjectSend to version r2029 or later.
Other vulnerabilities in ProjectSend
See all- CVE-2026-53992Medium
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
- CVE-2023-53980Critical
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
- CVE-2024-11680CriticalActively exploited
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- CVE-2021-47947Medium
Stored XSS in Projectsend r1295. Authenticated attackers can inject malicious script via the 'name' parameter in files-edit.php, which executes for administrators on the Dashboard.
- CVE-2020-28874High
A vulnerability in reset-password.php in ProjectSend before r1295 allows remote attackers to reset a user's password due to incorrect business logic. Errors are not properly considered, specifically an invalid token parameter.
Original NVD description (English source)
A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.