CVE-2026-5624

A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.

CVSS v3 4.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/projectsend/projectsend/
https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b
https://github.com/projectsend/projectsend/releases/tag/r2029
https://vuldb.com/submit/785731
https://vuldb.com/vuln/355414
https://vuldb.com/vuln/355414/cti

Configurations

No configuration.

History

24 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Una falla de seguridad ha sido descubierta en ProjectSend r2002. Esta vulnerabilidad afecta código desconocido del archivo upload.php. Realizar una manipulación resulta en falsificación de petición en sitios cruzados. El ataque puede ser iniciado remotamente. El exploit ha sido liberado al público y puede ser usado para ataques. Actualizar a la versión r2029 es capaz de resolver este problema. El parche se llama 2c0d25824ab571b6c219ac1a188ad9350149661b. Debería actualizar el componente afectado.

06 Apr 2026, 06:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-06 06:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-5624

Mitre link : CVE-2026-5624

CVE.ORG link : CVE-2026-5624

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-862

Missing Authorization

{"id": "CVE-2026-5624", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5624", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T13:58:16.051108Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "ProjectSend", "versions": [{"status": "affected", "version": "r2002"}, {"status": "unaffected", "version": "r2029"}]}]}], "published": "2026-04-06T06:16:21.623", "references": [{"url": "https://github.com/projectsend/projectsend/", "source": "cna@vuldb.com"}, {"url": "https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b", "source": "cna@vuldb.com"}, {"url": "https://github.com/projectsend/projectsend/releases/tag/r2029", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/785731", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/355414", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/355414/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en ProjectSend r2002. Esta vulnerabilidad afecta c\u00f3digo desconocido del archivo upload.php. Realizar una manipulaci\u00f3n resulta en falsificaci\u00f3n de petici\u00f3n en sitios cruzados. El ataque puede ser iniciado remotamente. El exploit ha sido liberado al p\u00fablico y puede ser usado para ataques. Actualizar a la versi\u00f3n r2029 es capaz de resolver este problema. El parche se llama 2c0d25824ab571b6c219ac1a188ad9350149661b. Deber\u00eda actualizar el componente afectado."}], "lastModified": "2026-07-24T09:10:00.153", "sourceIdentifier": "cna@vuldb.com"}