---
id: CVE-2026-100900
title: >-
  A vulnerability has been found in DevaslanPHP project-management
  1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1
summary: >-
  A vulnerability has been found in DevaslanPHP project-management
  1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function
  updateJiraProjects of the file /jira-import of the component Jira Import. The
  manipulation of the argument ho…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-918
vendor: DevaslanPHP
product: project-management
affected:
  - project-management 1.2.1
  - project-management 1.2.2
  - project-management 1.2.3
  - project-management 1.2.4
  - project-management v2.0.0-beta1
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T03:16:38.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100900'
references:
  - url: >-
      https://github.com/dddwmr/CVE/blob/main/Server-Side%20Request%20Forgery%20in%20Jira%20Import%20via%20Controllable%20Host%20and%20Missing%20canAccess%20.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-100900'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/919154'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/410850'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/410850/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-28T03:02:00.412Z'
---

## Overview

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host/username/token leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.