ProjectSend 2.0.0 through 2.6.x contains a path validation flaw in OrphanFileScanner::isOrphan that allows staff users who have import_orphans permission to treat files that are already tracked as orphans. By submitting a ./ path alias to the orphan import or delete endpoints, these users can delete or adopt files owned by other users, circumventing the delete_others_files restriction. The result is an elevation of privilege within the file management subsystem, enabling the removal or re‑ownership of files without the owner’s consent.

The affected product is ProjectSend version 2.0.0 up to, but not including, 2.7.0. The vulnerability is present in all releases between 2.0.0 and 2.6.x, inclusive. The official fix is provided in release 2.7.0.

With a CVSS score of 6, the flaw is considered medium severity. The EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated staff account with import_orphans permission, so the attack vector is limited to internal or compromised staff credentials rather than arbitrary remote users. An attacker with such access can delete or re‑ownership of any file, leading to potential data loss or unauthorized data exposure.