Path Traversal in ProjectSend File Management

Executive Summary

ProjectSend 2.0.0 before 2.7.0 has a path validation flaw in the OrphanFileScanner::isOrphan() function. Staff with import_orphans permission can submit ./ path aliases to treat tracked files as orphans. This allows deleting or adopting other users' files by bypassing delete_others_files permission checks.

Useful 0 Not Useful 0

Detection Guidance

Check ProjectSend versions 2.0.0 through 2.6.9 for the presence of OrphanFileScanner.php. Review logs for suspicious activity involving ./ path aliases in orphans import/delete endpoints. Inspect file deletion or adoption events by staff users with import_orphans permission.

Useful 0 Not Useful 0

Impact Analysis

An attacker with staff access and import_orphans permission could delete or take ownership of files belonging to other users. This could lead to data loss, unauthorized access to sensitive files, or disruption of services relying on those files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data integrity and confidentiality requirements or HIPAA's access controls. Organizations using affected versions may face compliance violations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ProjectSend to version 2.7.0 or later to patch the vulnerability. If upgrading is not possible, restrict staff users with import_orphans permission and monitor their activities closely. Review and audit file ownership and deletion logs for unauthorized changes.

Useful 0 Not Useful 0