ProjectSend r2002 contains a flaw in upload.php that permits cross‑site request forgery. An attacker could send a crafted HTTP request that triggers an action normally protected by the user’s session, allowing unauthorized file uploads or other privileged actions. The CVE description refers to this as a CSRF vulnerability (CWE‑352) and notes that the exploit has been publicly released, indicating that remote attackers can target the vulnerable component.

Any installation of ProjectSend running version r2002 or earlier is affected, since the flaw resides in upload.php. The vendor recommends upgrading to release r2029, which incorporates the fix identified by commit 2c0d25824ab571b6c219ac1a188ad9350149661b. No other products or vendors are listed.

The CVSS score of 5.3 reflects moderate severity, though EPSS data is not available and the vulnerability is not listed in the KEV catalog. Based on the description, it is inferred that the attack can be initiated remotely, and the existence of a public exploit suggests that attackers can employ the flaw to perform unauthorized actions over the network. Consequently, the risk is moderate and the vulnerability can be exploited without specialized prerequisites.