CVE-2026-53992 ProjectSend CVE debrief

Who should care

Administrators and users of ProjectSend r2029, especially those with edit_settings permissions, should be aware of this vulnerability and take necessary defensive actions to prevent exploitation.

Technical summary

The ProjectSend r2029 version contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php. The vulnerability allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. An attacker can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions.

Defensive priority

Medium-priority defensive actions are required to address the reflected cross-site scripting vulnerability in ProjectSend r2029.

Recommended defensive actions

• Inventory and verify ProjectSend installations to identify potential exposure.
• Implement input validation and output encoding for user-supplied data in thumbnails-regenerate.php.
• Restrict access to the thumbnails-regenerate.php script to only authorized users.
• Monitor for suspicious activity and implement compensating controls as needed.
• Apply vendor patches or updates when available.

Evidence notes

The CVE description indicates a reflected cross-site scripting vulnerability in ProjectSend r2029, specifically in thumbnails-regenerate.php. The vulnerability allows remote attackers to inject arbitrary HTML and JavaScript via unsanitized values in the start_date and end_date GET parameters. However, details about the vendor's response, affected scope, and potential impact are limited.

Official resources