CVE-2026-5624 ProjectSend CVE debrief

Who should care

Users of ProjectSend r2002 and r2028 should be aware of this cross-site request forgery vulnerability and take steps to upgrade to version r2029, review compensating controls, and monitor for potential exploitation attempts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess exposure and apply patches or mitigations promptly.

Technical summary

The vulnerability is a cross-site request forgery issue in the file upload.php of ProjectSend r2002. The attack can be initiated remotely and has been publicly disclosed. The patch for this issue is named 2c0d25824ab571b6c219ac1a188ad9350149661b. Affected product deployments should be verified, and patches or mitigations should be applied promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly.

Defensive priority

Low-Moderate due to public exploit availability and potential for remote initiation, despite low CVSS score indicating limited impact under most configurations. Users should prioritize based on actual exposure and potential operational impact within their environments, considering compensating controls and monitoring for exposed assets while remediation is planned and verified. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to untrusted networks or users. Limited evidence suggests that defenders should focus on verifying affected deployments and applying patches or mitigations promptly to prevent potential misuse by attackers in environments where the vulnerable component is exposed to

Recommended defensive actions

• Upgrade to version r2029
• Review and apply the patch 2c0d25824ab571b6c219ac1a188ad9350149661b
• Monitor for remote exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-06T06:16:21.623Z and was last modified on 2026-07-24T09:10:00.153Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify affected product deployments, review official advisories, and plan updates or mitigations through normal change control.

Official resources