Is there a patch available for CVE-2026-5624?

Yes, a patch is available for CVE-2026-5624. Update the affected software to the latest version immediately.

PHP CVE-2026-5624

Q: What is the CVSS score of CVE-2026-5624?

CVE-2026-5624 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19176 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-06 VulDB

GHSA-8x9f-c335-83wq

CSRF PHP File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 06, 2026 - 05:45 euvd

EUVD-2026-19176

Analysis Generated

Apr 06, 2026 - 05:45 vuln.today

Patch released

Apr 06, 2026 - 05:45 nvd

Patch available

CVE Published

Apr 06, 2026 - 05:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version r2029 is able to resolve this issue. The patch is named 2c0d25824ab571b6c219ac1a188ad9350149661b. You should upgrade the affected component.

AnalysisAI

Cross-site request forgery (CSRF) in ProjectSend r2002 allows unauthenticated remote attackers to perform unauthorized file upload operations via the upload.php endpoint with user interaction (UI:R). The vulnerability has been publicly disclosed with exploit code available, and ProjectSend has released patched version r2029 with commit 2c0d25824ab571b6c219ac1a188ad9350149661b to remediate the issue. While the CVSS score of 4.3 indicates low-to-moderate severity, the presence of public exploit code and lack of authentication requirements elevates the real-world risk for unpatched instances.

Technical ContextAI

ProjectSend is a PHP-based open-source file sharing application. The vulnerability resides in the upload.php file and is rooted in a Cross-Site Request Forgery (CWE-352) weakness, a class of vulnerability where an attacker can trick authenticated users into unwittingly submitting requests to perform actions on the target application. The attack mechanism exploits insufficient CSRF token validation or absence of proper anti-CSRF protections in the file upload handling logic. The CVSS vector indicates the attack requires user interaction (UI:R) and network accessibility (AV:N) with low attack complexity (AC:L), meaning a user must be socially engineered or tricked into visiting a malicious page while logged into ProjectSend. The PR:N rating confirms no authentication credentials are needed from the attacker themselves; the attacker leverages the victim's authenticated session.

RemediationAI

ProjectSend users should upgrade immediately to version r2029 or later, which includes the security fix via commit 2c0d25824ab571b6c219ac1a188ad9350149661b. The patched release is available at https://github.com/projectsend/projectsend/releases/tag/r2029. For organizations unable to upgrade immediately, implement network-level protections such as WAF (Web Application Firewall) rules to detect and block suspicious file upload requests to upload.php, enforce SameSite cookie attributes in application configuration if supported, and educate users against clicking untrusted links while authenticated to ProjectSend. Verify successful patching by confirming the commit hash 2c0d25824ab571b6c219ac1a188ad9350149661b is present in the running deployment. Additional hardening information is available via the VulDB references at https://vuldb.com/vuln/355414.