Executive brief
ProjectSend, an open-source file-sharing platform, contains a security flaw that could allow an attacker to trick an authenticated user into performing unintended actions. Specifically, a malicious website could trigger unauthorized file uploads using the victim's active session. This could lead to unauthorized data being placed on the server or potential disruption of file management operations.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectSend r2002 within the upload.php and upload.process.php components. The vulnerability stems from a bypass in the CSRF validation logic (csrf.php) when the FILE_UPLOADING constant was present, combined with the use of $_REQUEST instead of strictly $_POST for parameter handling. A remote attacker can exploit this by enticing an authenticated user to visit a malicious webpage, which then executes a forged request to the upload endpoint. This allows the attacker to upload files to the server under the context of the victim's account. The issue is resolved in version r2029 by removing the validation bypass and enforcing CSRF tokens for all upload chunks.
Affected products
- ProjectSend ProjectSend r2002
Timeline
- 2026-03-29: patched: Version r2029 released with fix
- 2026-04-06: disclosed: Initial vulnerability disclosure
- 2026-04-06: advisory: NVD publication date