CVE-2026-5624

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-5624

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5624.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-5624

Published

2026-04-06T05:00:19.673Z

Modified

2026-08-17T03:55:03.975988323Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

ProjectSend upload.php cross-site request forgery

Details

A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.

Database specific

{
    "cwe_ids": [
        "CWE-352",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5624.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/projectsend/projectsend

Affected ranges

Type

GIT

Repo

https://github.com/projectsend/projectsend

Events

Introduced

2b58919b33ff4a1f097e5bc7bb0fad7a9f84f4fa

Fixed

2c0d25824ab571b6c219ac1a188ad9350149661b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "r2002"
        },
        {
            "last_affected": "r2002"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other

r2002

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5624.json"