PT-2026-30567 · Unknown · Projectsend

Aquanight · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5624

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ProjectSend version r2002

Description A security flaw has been discovered in ProjectSend r2002 affecting unknown code within the upload.php file. A manipulation of this code results in cross-site request forgery, and the attack can be initiated remotely. The exploit has been released publicly.

Recommendations Upgrade to version r2029 to resolve this issue.

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2026-5624

Affected Products

Projectsend

References · 9

• https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b · Patch
• https://github.com/projectsend/projectsend/releases/tag/r2029 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5624 · Security Note
• https://vuldb.com/vuln/355414/cti · Note
• https://github.com/projectsend/projectsend · Note
• https://twitter.com/infoflowcloud/status/2041032161747202159 · Twitter Post
• https://twitter.com/CVEnew/status/2041031314590310782 · Twitter Post
• https://vuldb.com/vuln/355414 · Note
• https://vuldb.com/submit/785731 · Note