CVE-2026-112003

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

EUVD-2026-103456

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...

CVE-2026-112003

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to a path validation flaw within the OrphanFileScanner::isOrphan() function. This flaw allows staff members with import_orphans permissions to bypass the delete_others_files restriction by submitting ./ path aliases to the orphans import or d...

CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff with importorphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files...