Quick answers
- Is CVE-2026-5624 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5624 being exploited in the wild.
- How severe is CVE-2026-5624?
- Medium severity, with a CVSS score of 4.3, published 6 April 2026.
- Which products and versions are affected?
- ProjectSend r2002.
- Is there a fix for CVE-2026-5624?
- A patch was published on 2026-03-29: Version r2029 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-5624 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-5624?
- Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectSend r2002 within the upload.php and upload.process.php components. The vulnerability stems from a bypass in the CSRF validation logic (csrf.php) when the FILE_UPLOADING constant was present, combined with the use of $_REQUEST instead of strictly $_POST for parameter handling. A remote attacker can exploit this by enticing an authenticated user to visit a malicious webpage, which then executes a forged request to the upload endpoint. This allows the attacker to upload files to the server under the context of the victim's account. The issue is resolved in version r2029 by removing the validation bypass and enforcing CSRF tokens for all upload chunks.
Affected products
- ProjectSend ProjectSend r2002
Timeline
- 2026-03-29: patched: Version r2029 released with fix
- 2026-04-06: disclosed: Initial vulnerability disclosure
- 2026-04-06: advisory: NVD publication date