CVE-2026-112003Medium· 5.9▾ SunlitProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans impor…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
ProjectSend >= 2.0.0 < 2.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112001High· 7.2ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
CVE-2026-112002Medium· 6.8ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
CVE-2024-11680Critical· 9.8ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability
CVE-2020-28874High· 7.5reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic
CVE-2026-100409High· 7.5OpenNext Cloudflare is an open Next.js adapter for Cloudflare
CVE-2026-110846High· 7.0n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form