CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

EUVD-2026-103456

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to a path validation flaw within the OrphanFileScanner::isOrphan() function. This flaw allows staff members with import_orphans permissions to bypass the delete_others_files restriction by submitting ./ path aliases to the orphans import or d...

CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003: Incorrect Behavior Order: Validate Before Canonicalize

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

PT-2026-116607

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with import orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' file...

ProjectSend processing logic error vulnerability

Versions of ProjectSend from 2.0.0 to 2.7.0 have a processing logic vulnerability. This vulnerability stems from a path validation flaw in OrphanFileScanner::isOrphan. Employees with the importorphans permission can treat tracked files as isolated files. An attacker can import or delete endpoints...