Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-116136— ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

Quick assessment

Affected

projectsend ProjectSend

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ProjectSend 2.0.0 至 2.7.1 版本在 FileVersions::link() 方法中存在授权不完整漏洞。该漏洞允许工作人员用户通过链接文件版本，在未经授权的情况下共享文件。攻击者可将其文件链接到中间修订版本，或将文件分配给超出作用域的客户，从而触发 moveAssignmentsToRoot() 函数，导致受保护的原始文件被未授权客户访问。

CVSS 5.9 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1551 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

Source: CVE Program / CVE List V5

Vulnerability Description

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
projectsend	ProjectSend	2.0.0 ~ 2.7.1	-

II. Public POCs for CVE-2026-116136

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116136

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116136 (2)

Vendor Advisories for CVE-2026-116136 (1)

🔗 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking | Advisories | VulnCheck third-party-advisory

Vendor Pages for CVE-2026-116136 (1)

🔗 GitHub - projectsend/projectsend: ProjectSend is a free, open source software that lets you share files with your clients, focused on ease of use and privacy. It supports clients groups, system users roles, statistics, multiple languages, detailed logs... and much more! · GitHub Read full article product

https://www.cve.org/CVERecord?id=CVE-2026-116136

IV. Related Vulnerabilities

Same product: ProjectSend

Same vendor: projectsend

Same weakness: CWE-863