CVE-2026-53992: Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with editsettings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53992?
The severity of CVE-2026-53992 is medium with a CVSS score of 6.1.
How do I fix CVE-2026-53992?
To fix CVE-2026-53992, ensure that user input from the start_date and end_date parameters is properly sanitized and escaped before rendering.
What type of vulnerability is associated with CVE-2026-53992?
CVE-2026-53992 is associated with a reflected cross-site scripting (XSS) vulnerability.
Which software is affected by CVE-2026-53992?
CVE-2026-53992 affects ProjectSend version r2029.
What parameters are involved in the CVE-2026-53992 vulnerability?
The parameters involved in the CVE-2026-53992 vulnerability are start_date and end_date.