CVE-2026-53992

Name of the Vulnerable Software and Affected Versions ProjectSend version r2029

Description Reflected cross-site scripting occurs in the 'thumbnails-regenerate.php' endpoint. Remote attackers can inject arbitrary HTML and JavaScript by providing unsanitized values through the start date and end date GET parameters, which are echoed unescaped into HTML attribute values. An authenticated victim with edit settings permissions who follows a malicious URL may have scripts executed in the application origin, potentially leading to the theft of session cookies or unauthorized actions such as user management, file management, and changes to application settings.

Recommendations For version r2029, avoid using the start date and end date parameters in the 'thumbnails-regenerate.php' endpoint until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.