CVE-2026-112003 ProjectSend CVE debrief

Who should care

Defenders responsible for ProjectSend instances, particularly those with staff having import_orphans permission, should assess exposure and prioritize compensating controls to prevent unauthorized file deletion or adoption. This includes reviewing access controls, monitoring instance logs, and verifying the exposure of their ProjectSend instances. Additionally, security teams and vulnerability management teams should be aware of the potential impact of the

Why it matters

CVE-2026-112003 is a path validation flaw in ProjectSend 2.0.0 before 2.7.0 that allows staff with import_orphans permission to treat tracked files as orphans, potentially deleting or adopting other owners' files. Defenders responsible for ProjectSend instances should assess exposure and prioritize compensating controls.

• Staff with import_orphans permission can potentially delete or adopt other owners' files
• Requires verification of ProjectSend instance exposure and compensating controls
• May necessitate review and update of access controls for ProjectSend instances

Technical summary

The path validation flaw in ProjectSend 2.0.0 before 2.7.0 allows staff with import_orphans permission to treat tracked files as orphans, potentially deleting or adopting other owners' files by submitting ./ path aliases to the orphans import or delete endpoints. The vulnerability exists in the OrphanFileScanner::isOrphan() function and can be exploited by staff with import_orphans permission. Defenders should prioritize verifying exposure and assessing compensating controls for ProjectSend instances with staff having import_orphans permission.

Defensive priority

Defenders should prioritize verifying exposure and assessing compensating controls for ProjectSend instances with staff having import_orphans permission.

Recommended defensive actions

• Verify ProjectSend instance exposure and assess compensating controls for staff with import_orphans permission
• Review and update access controls for ProjectSend instances to prevent unauthorized file deletion or adoption
• Monitor ProjectSend instance logs for suspicious activity related to orphans import or delete endpoints
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The flaw exists in OrphanFileScanner::isOrphan() and can be exploited by submitting ./ path aliases to the orphans import or delete endpoints. The vulnerability allows staff with import_orphans permission to treat tracked files as orphans, potentially deleting or adopting other owners' files. Defenders should verify the exposure of their ProjectSend instances and review access controls to prevent exploitation. The source code review indicates that the issue is related to the handling of file paths in the OrphanFileScanner class.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.