Login Request a demo
Medium severity · published Apr 6, 2026
CVE-2026-5624
ProjectSend upload.php cross-site request forgery
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
ProjectSend · Projectsend
r2002 · source: vendor
Affected product
PR
ProjectSend
Projectsend
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5624
github.com
https://github.com/projectsend/projectsend/
github.com
https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b
github.com
https://github.com/projectsend/projectsend/releases/tag/r2029
vuldb.com
https://vuldb.com/submit/785731
vuldb.com
https://vuldb.com/vuln/355414
vuldb.com
https://vuldb.com/vuln/355414/cti
More from ProjectSend
9.8
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
9.8
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string