---
id: CVE-2026-53992
title: >-
  ProjectSend r2029 contains a reflected cross-site scripting vulnerability in
  thumbnails-regenerate.php that allows remote attackers to inject arbitrary
  HTML and JavaScript by supplying unsanitized values in the start_date and
  end_date GE…
summary: >-
  ProjectSend r2029 contains a reflected cross-site scripting vulnerability in
  thumbnails-regenerate.php that allows remote attackers to inject arbitrary
  HTML and JavaScript by supplying unsanitized values in the start_date and
  end_date GE…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-05'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53992'
references:
  - url: 'https://github.com/projectsend/projectsend'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/projectsend/projectsend/commit/b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/reflected-xss-in-projectsend-thumbnails-regenerate-php-via-start-date-end-date-parameters
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00403
epssPercentile: 0.31709
ingestedAt: '2026-09-24T20:51:40.180Z'
---

## Overview

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.