Live › vulnerability › CVE-2026-112003
Go to dashboardProjectSend 2.0.0 before 2.7.0 fails to validate paths in its orphan-file scanner, so a staff user with import_orphans permission can submit ./ path aliases. The attacker can delete or adopt files owned by other users, bypassing the delete_others_files permission.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sources do not name a product to avoid beyond ProjectSend itself; the flaw needs a staff account holding the import_orphans permission, so installations with only administrators or no orphan-import use are less exposed. Self-hosted ProjectSend instances in the 2.0.0 to 2.6.x range are the systems to look at.
No product ranges from the sources yet.
2.0.0 up to but not including 2.7.0.2.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
This page as .md · .json · in your agent: get_signal("CVE-2026-112003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.