CVE-2026-53992 Details

A reflected cross-site scripting vulnerability has been identified in ProjectSend version r2029, specifically within the thumbnails-regenerate.php file. This vulnerability allows remote attackers to inject arbitrary HTML and JavaScript by sending unsanitized values through the start_date and end_date GET parameters. The injected scripts are echoed back into the HTML as attribute values without proper escaping. Exploitation of this vulnerability requires the attacker to craft a malicious URL that, when clicked by an authenticated user with edit_settings permissions, executes the injected scripts in the context of the application. This could lead to theft of session cookies or unauthorized actions such as managing users, files, or application settings.

Users can update to the latest version of ProjectSend, where this vulnerability has been patched. Instructions for updating are available in the project's documentation.