CVE-2026-112003 in ProjectSend
Summary
by MITRE • 10/18/2026
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in ProjectSend versions prior to 2.7.0 represents a critical failure in input validation and access control mechanisms within the file management subsystem. Specifically, the flaw resides in the OrphanFileScanner::isOrphan() method, which is responsible for determining whether uploaded files are unassociated with any user account or project. This function serves as a gatekeeper for operations involving orphaned files, such as importing them into existing accounts or permanently deleting them from the system. The core technical deficiency lies in how the application processes file path aliases during these operations. When staff members possessing the import_orphans permission interact with the endpoints designed to handle orphaned files, the backend logic fails to adequately sanitize or validate the provided file paths against a strict allowlist of acceptable directory structures. This lack of rigorous validation allows for the injection of relative path sequences, specifically the ./ notation, which is interpreted by the underlying operating system and application framework as a reference to the current working directory rather than a specific orphaned file entry.
This technical flaw effectively bypasses intended access controls designed to protect user data integrity. In a properly secured environment, operations on files belonging to other users should be restricted or require elevated privileges that explicitly include permissions like delete_others_files. However, by manipulating the path resolution through the use of ./ aliases, an attacker can trick the application into treating arbitrary tracked files as if they were orphaned assets. This misclassification allows a user with only basic import_orphans capabilities to perform actions on files owned by other users without triggering the higher-level permission checks that would normally prevent such interference. The vulnerability essentially creates a logic bypass where the system's assumption about file ownership is subverted through path manipulation, leading to unauthorized access and modification of resources outside the attacker's designated scope.
The operational impact of this vulnerability is severe, particularly in multi-tenant or collaborative environments where data isolation between users is paramount. An authenticated attacker can exploit this flaw to delete files belonging to other staff members, resulting in permanent data loss and disruption of business operations. Alternatively, by adopting these misidentified orphaned files into their own account, the attacker gains unauthorized access to sensitive documents, potentially leading to significant confidentiality breaches. This capability undermines the fundamental principle of least privilege, as users are able to perform actions that exceed their assigned role permissions without detection or authorization from system administrators. The ability to delete others' files also poses a risk to audit trails and compliance requirements, as critical records may be removed in ways that do not align with standard deletion protocols, potentially obscuring forensic evidence of the attack itself.
To mitigate this vulnerability, immediate updates to ProjectSend are required by upgrading to version 2.7.0 or later, where the path validation logic has been corrected to properly restrict file operations to explicitly defined orphaned entries rather than accepting arbitrary path aliases. In addition to applying vendor patches, administrators should enforce strict input validation on all endpoints that handle file system interactions, ensuring that only canonical paths are processed and that relative navigation sequences like ./ or ../ are strictly rejected at the application layer. Access control lists must be reviewed to ensure that permissions such as import_orphans do not inadvertently grant excessive privileges over files outside the user's ownership scope. Furthermore, implementing comprehensive logging for all file deletion and adoption events can aid in detecting any attempted exploitation of this flaw before significant damage occurs. Regular security audits focusing on path traversal vulnerabilities are recommended to maintain robust defense-in-depth strategies against similar logic flaws.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves the failure to enforce proper restrictions on authorized users performing actions beyond their intended permissions. It also relates closely to CWE-73 External Control of File Name or Path, specifically regarding the insufficient validation of user-supplied input used in file system operations. In terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1083 File and Directory Discovery combined with T1229 Transferred Data Obfuscation via path manipulation, although primarily it is categorized under privilege escalation through logic flaws rather than traditional injection attacks. The exploitation relies on the application's trust in user-supplied paths without verifying their actual relationship to the intended orphaned file set, highlighting a common pattern where business logic assumptions are exploited by manipulating input parameters that influence internal state decisions.