CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
Staff users can bypass path validation to delete or adopt other users' files via orphan file endpoints, compromising data integrity and access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112003?
CVE-2026-112003 is a medium-severity path traversal vulnerability in ProjectSend, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
Weakness: CWE-180
Which versions are affected by CVE-2026-112003?
How do I fix CVE-2026-112003?
No fix has been published for CVE-2026-112003 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-112003 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112003 exists.
Sources
Also known as GHSA-f5fh-phpc-hrv4, GHSA-pv88-7863-5hwq.