CVE-2026-112003
MEDIUM
6,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: low
Description
AI Translation Available
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0036
Percentile
0,3th
Updated
EPSS Score Trend (Last 2 Days)
180
Incorrect Behavior Order: Validate Before Canonicalize
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/projectsend/projectsend/security/advisories/GHSA-pv88-7863-5…
https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Files/Orphan…
https://github.com/projectsend/projectsend/commit/1e34773ad39c256f1320f4d2b47b9…
https://github.com/projectsend/projectsend/releases/tag/v2.7.0
https://github.com/projectsend/projectsend/security/advisories/GHSA-pv88-7863-5…
https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-path-valida…