CVE-2026-5624 Details
Description
A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.
A cross-site request forgery (CSRF) vulnerability has been identified in ProjectSend version r2002. The issue arises in the file upload functionality within upload.php, where the absence of proper CSRF protection allows attackers to exploit the endpoint. The vulnerability can be triggered remotely by manipulating HTTP methods, converting a POST request into a GET request, and uploading files without the user's consent. This exploitation takes advantage of the lack of validation for requests, enabling unauthorized file uploads using an authenticated user's session.
Users are advised to upgrade to ProjectSend version r2029, which addresses this vulnerability by restoring proper CSRF validation on the file upload endpoint. The updated version is available for download from the ProjectSend GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 6, 2026CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectsend/projectsend/ | [email protected] | Vendor |
| https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b | [email protected] | Source CodeVendor |
| https://github.com/projectsend/projectsend/releases/tag/r2029 | [email protected] | Release NotesVendor |
| https://vuldb.com/submit/785731 | [email protected] | Technical Description |
| https://vuldb.com/vuln/355414 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/355414/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjectSend | r2002 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |