CVE-2026-112003

Name of the Vulnerable Software and Affected Versions ProjectSend versions 2.0.0 through 2.6.9

Description A path validation flaw exists in the isOrphan() function of the OrphanFileScanner class. This issue allows staff members with the import orphans permission to misidentify tracked files as orphans. By submitting ./ path aliases to the orphans import or delete endpoints, an attacker can delete or adopt files belonging to other owners, effectively bypassing the delete others files restriction.

Recommendations Update ProjectSend to version 2.7.0 or later.