Path Validation Flaw in ProjectSend Affects File Management

CVE-2026-112003

What is CVE-2026-112003?

A path validation flaw has been identified in ProjectSend, specifically within the OrphanFileScanner::isOrphan() function, present in versions prior to 2.7.0. This vulnerability allows users with import_orphans permission to manipulate file tracking mechanisms. Attackers can exploit this flaw by submitting malicious path aliases to the orphan import or delete endpoints, thus enabling them to delete or adopt ownership of files that are not theirs, circumventing normal file deletion restrictions put in place by the application. This could lead to unauthorized access and removal of sensitive data, posing a significant risk to data integrity.

References