CVE-2026-112003: ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing deleteothersfiles.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs staff-level access with the import_orphans permission. Exploitation does not require user interaction, but it requires submitting requests to the orphan-file import or delete endpoints.
What actions can an attacker perform?
A permitted staff user can use ./ path aliases to cause tracked files to be treated as orphaned. This can let them delete files owned by other users or adopt those files, bypassing the delete_others_files restriction.
Which versions are affected and what version fixes the issue?
ProjectSend versions from 2.0.0 through versions before 2.7.0 are affected. Version 2.7.0 is identified as the fixed release.