CVE-2026-100900 DevaslanPHP CVE debrief

Who should care

Defenders responsible for DevaslanPHP project-management deployments should assess exposure and verify affected versions. Defenders should prioritize verifying affected versions and assessing exposure in their environment. The vulnerability affects DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1 in the Jira Import component.

Why it matters

A server-side request forgery vulnerability was found in DevaslanPHP project-management, which can be exploited remotely. Defenders should prioritize verifying affected versions and assessing exposure in their environment.

• Verify affected versions of DevaslanPHP project-management.
• Assess exposure to the Jira Import component.
• Monitor for potential server-side request forgery attacks.

Technical summary

The vulnerability is due to the manipulation of the argument host/username/token in the file /jira-import, which leads to server-side request forgery. The attack can be initiated remotely. Defenders should prioritize verifying the affected versions and assessing exposure in their environment. The vulnerability affects DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1 in the Jira Import component. The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure in their environment.

Recommended defensive actions

• Verify the affected versions of DevaslanPHP project-management in your environment.
• Assess exposure to the Jira Import component.
• Monitor for potential server-side request forgery attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The attack can be initiated remotely and defenders should prioritize verifying affected versions and assessing exposure in their environment. The vulnerability is due to the manipulation of the argument host/username/token in the file /jira-import.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.