EUVD-2026-53394
GHSA-5fp2-v633-2824
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring privileged victim to click a crafted link (UI:R); scope changes to browser context (S:C) enabling session theft and downstream admin actions; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.
AnalysisAI
Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.
Technical ContextAI
ProjectSend is a self-hosted, open-source PHP file-sharing application (CPE: cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS pattern where user-supplied GET parameters - start_date and end_date - are assigned directly from $_GET without sanitization in thumbnails-regenerate.php. These values are then embedded unescaped into HTML attribute values, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript. The fix, visible in commit b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324, wraps both parameters with htmlspecialchars($value, ENT_QUOTES, 'UTF-8'), which correctly encodes quotes and angle brackets to prevent attribute-context injection.
RemediationAI
The primary fix is applying the upstream patch from commit b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324 (https://github.com/projectsend/projectsend/commit/b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324), which adds htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to the start_date and end_date GET parameter assignments in thumbnails-regenerate.php. Note that a specific tagged release version containing this fix has not been independently confirmed from the available data - administrators should apply the commit directly or monitor the upstream repository for a formal release. As a compensating control prior to patching, access to thumbnails-regenerate.php can be restricted at the web server level (e.g., via nginx location block or Apache .htaccess deny rules) to trusted IP ranges or VPN-only access, though this may disrupt thumbnail management workflows. User awareness training to avoid clicking unsolicited links sent to privileged accounts is a secondary mitigating measure. Additional context is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/reflected-xss-in-projectsend-thumbnails-regenerate-php-via-start-date-end-date-parameters.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today