# CVE-2026-112003: ProjectSend path validation flaw in OrphanFileScanner

Source: https://junglewise.ai/threats/cve-2026-112003-projectsend-2-0-0-before-2-7-0-contains-a-path-validation-flaw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-112003 · Severity: medium · CVSS 5.9 · Published 2026-10-18

ProjectSend is a web-based file distribution platform that manages file uploads and permissions for staff and clients. A flaw in the orphan file scanner allows staff with import permission to delete or reassign other users' files by submitting specially-crafted file paths, bypassing the normal delete-others-files permission check. This could result in unauthorized file loss or file ownership manipulation by authorized staff.

Technologies: [ProjectSend](https://junglewise.ai/threats/technologies/projectsend). Vendors: [ProjectSend](https://junglewise.ai/threats/vendors/projectsend).

## Quick answers

**Is CVE-2026-112003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112003 being exploited in the wild.

**How severe is CVE-2026-112003?** Medium severity, with a CVSS score of 5.9, published 18 October 2026.

**Which products and versions are affected?** ProjectSend 2.0.0 before 2.7.0.

**Is there a fix for CVE-2026-112003?** Yes: fixed in ProjectSend 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112003 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112003?** Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ProjectSend 2.7.0

## Technical details

The OrphanFileScanner::isOrphan() method fails to canonicalize file paths before comparing them against tracked files in the database. An attacker with import_orphans permission can submit path aliases like "./" sequences that the Flysystem storage layer normalizes differently, causing legitimately tracked files to appear as orphans. This allows deletion or adoption of other owners' files while circumventing the delete_others_files access control check.

## Affected products

- ProjectSend ProjectSend 2.0.0 before 2.7.0

## Timeline

- 2026-10-18: disclosed
- 2026-10-18: patched: Fix in commit 1e34773: isOrphan() now refuses paths that the storage normalizer would rewrite

## References

- [https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Files/OrphanFileScanner.php](https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Files/OrphanFileScanner.php)
- [https://github.com/projectsend/projectsend/commit/1e34773ad39c256f1320f4d2b47b93a5805f07c6](https://github.com/projectsend/projectsend/commit/1e34773ad39c256f1320f4d2b47b93a5805f07c6)

## Related threats

- [ProjectSend incomplete authorization in FileVersions::link()](https://junglewise.ai/threats/cve-2026-116136-projectsend-2-0-0-through-2-7-1-contains-an-incomplete)
- [ProjectSend password change authentication bypass in social-provisioned accounts](https://junglewise.ai/threats/cve-2026-112002-projectsend-2-5-0-before-2-7-0-contains-an-unverified-password)
- [ProjectSend authorization bypass via API token privilege escalation](https://junglewise.ai/threats/cve-2026-112001-projectsend-2-0-0-before-2-7-0-contains-an-incorrect)
- [ProjectSend stored XSS in files-edit.php](https://junglewise.ai/threats/cve-2021-47947-projectsend-stored-xss-in-files-edit-php)
- [ProjectSend CSRF in file upload endpoint](https://junglewise.ai/threats/cve-2026-5624-projectsend-csrf-in-file-upload-endpoint)