# CVE-2026-5624: ProjectSend CSRF in file upload endpoint

Source: https://junglewise.ai/threats/cve-2026-5624-projectsend-csrf-in-file-upload-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5624 · Severity: medium · CVSS 4.3 · Published 2026-04-06

ProjectSend, an open-source file-sharing platform, contains a security flaw that could allow an attacker to trick an authenticated user into performing unintended actions. Specifically, a malicious website could trigger unauthorized file uploads using the victim's active session. This could lead to unauthorized data being placed on the server or potential disruption of file management operations.

Technologies: [ProjectSend](https://junglewise.ai/threats/technologies/projectsend). Vendors: [ProjectSend](https://junglewise.ai/threats/vendors/projectsend).

## Quick answers

**Is CVE-2026-5624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5624 being exploited in the wild.

**How severe is CVE-2026-5624?** Medium severity, with a CVSS score of 4.3, published 6 April 2026.

**Which products and versions are affected?** ProjectSend r2002.

**Is there a fix for CVE-2026-5624?** A patch was published on 2026-03-29: Version r2029 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5624 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-5624?** Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectSend r2002 within the upload.php and upload.process.php components. The vulnerability stems from a bypass in the CSRF validation logic (csrf.php) when the FILE_UPLOADING constant was present, combined with the use of $_REQUEST instead of strictly $_POST for parameter handling. A remote attacker can exploit this by enticing an authenticated user to visit a malicious webpage, which then executes a forged request to the upload endpoint. This allows the attacker to upload files to the server under the context of the victim's account. The issue is resolved in version r2029 by removing the validation bypass and enforcing CSRF tokens for all upload chunks.

## Affected products

- ProjectSend ProjectSend r2002

## Timeline

- 2026-03-29: patched: Version r2029 released with fix
- 2026-04-06: disclosed: Initial vulnerability disclosure
- 2026-04-06: advisory: NVD publication date

## References

- [https://github.com/projectsend/projectsend/](https://github.com/projectsend/projectsend/)
- [https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b](https://github.com/projectsend/projectsend/commit/2c0d25824ab571b6c219ac1a188ad9350149661b)
- [https://github.com/projectsend/projectsend/releases/tag/r2029](https://github.com/projectsend/projectsend/releases/tag/r2029)
- [https://vuldb.com/submit/785731](https://vuldb.com/submit/785731)
- [https://vuldb.com/vuln/355414](https://vuldb.com/vuln/355414)
- [https://vuldb.com/vuln/355414/cti](https://vuldb.com/vuln/355414/cti)

## Related threats

- [ProjectSend incomplete authorization in FileVersions::link()](https://junglewise.ai/threats/cve-2026-116136-projectsend-2-0-0-through-2-7-1-contains-an-incomplete)
- [ProjectSend path validation flaw in OrphanFileScanner](https://junglewise.ai/threats/cve-2026-112003-projectsend-2-0-0-before-2-7-0-contains-a-path-validation-flaw)
- [ProjectSend password change authentication bypass in social-provisioned accounts](https://junglewise.ai/threats/cve-2026-112002-projectsend-2-5-0-before-2-7-0-contains-an-unverified-password)
- [ProjectSend authorization bypass via API token privilege escalation](https://junglewise.ai/threats/cve-2026-112001-projectsend-2-0-0-before-2-7-0-contains-an-incorrect)
- [ProjectSend stored XSS in files-edit.php](https://junglewise.ai/threats/cve-2021-47947-projectsend-stored-xss-in-files-edit-php)