ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
ProjectSend, a self-hosted file-sharing application, is affected in versions from 2.0.0 through 2.7.1. A staff user can abuse a flaw in how file versions are linked to share files they are not authorized to share, which can expose protected original files to clients who should not have access to them.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- projectsend ProjectSend
From 2.0.0 · through 2.7.1