CVE-2026-53992: ProjectSend r2029 XSS Vulnerability

CVE-2026-53992 Overview

CVE-2026-53992 is a reflected cross-site scripting (XSS) vulnerability in ProjectSend r2029. The flaw resides in thumbnails-regenerate.php, which echoes the start_date and end_date GET parameters unescaped into HTML attribute values. Remote attackers can craft a malicious URL that injects arbitrary HTML and JavaScript into the page. When an authenticated user holding edit_settings permissions follows the link, the injected script executes in the application origin. This grants the attacker the ability to steal session cookies or perform unauthorized actions in the victim's session, including user management, file management, and application settings changes. The issue is tracked under [CWE-79].

Critical Impact
Successful exploitation lets an attacker hijack a privileged ProjectSend administrator session and perform user management, file management, and settings changes in the application origin.

Affected Products

ProjectSend r2029
Earlier ProjectSend releases containing the vulnerable thumbnails-regenerate.php
Web deployments exposing ProjectSend administration to browser-based access

Discovery Timeline

2026-08-05 - CVE CVE-2026-53992 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-53992

Vulnerability Analysis

The vulnerability is a reflected XSS in thumbnails-regenerate.php. The script reads the start_date and end_date values directly from the query string and reflects them into HTML attributes without encoding. Because the values land inside attribute contexts, an attacker can break out of the attribute with quotes and inject event handlers or script content. The payload executes in the browser of any authenticated user who visits the crafted URL. Users with edit_settings permissions represent the highest-value target because their session tokens authorize administrative operations.

Root Cause

The root cause is missing output encoding on user-controlled input. thumbnails-regenerate.php reads $_GET['start_date'] and $_GET['end_date'] and writes the raw values into the response markup. No sanitization or context-aware escaping is applied before the values reach the HTML attribute context.

Attack Vector

An attacker constructs a URL to thumbnails-regenerate.php containing malicious payloads in the start_date or end_date parameters. The attacker then delivers the link through phishing, chat, or a third-party site. When an authenticated administrator loads the URL, the browser renders the injected script under the ProjectSend origin. The script can read cookies not marked HttpOnly, issue authenticated requests to ProjectSend endpoints, or modify application state.

php

// Patch from ProjectSend commit b4ad95b - thumbnails-regenerate.php
// Handle date filter from GET parameters
-$filter_start_date = isset($_GET['start_date']) ? $_GET['start_date'] : null;
-$filter_end_date = isset($_GET['end_date']) ? $_GET['end_date'] : null;
+$filter_start_date = isset($_GET['start_date']) ? htmlspecialchars($_GET['start_date'], ENT_QUOTES, 'UTF-8') : null;
+$filter_end_date = isset($_GET['end_date']) ? htmlspecialchars($_GET['end_date'], ENT_QUOTES, 'UTF-8') : null;

// Re-calculate statistics with filtered dates if provided
if ($filter_start_date || $filter_end_date) {

Source: GitHub Commit b4ad95b. The fix wraps both parameters with htmlspecialchars() using ENT_QUOTES and UTF-8, encoding both single and double quotes so the values cannot break out of HTML attribute contexts.

Detection Methods for CVE-2026-53992

Indicators of Compromise

Web server access logs containing requests to thumbnails-regenerate.php with start_date or end_date values holding angle brackets, quotes, script, onerror, onload, or URL-encoded equivalents.
Referer headers pointing to untrusted external origins immediately before administrative actions in ProjectSend.
Unexpected user, file, or settings changes performed by accounts with edit_settings permissions shortly after visiting a crafted URL.

Detection Strategies

Enable WAF or reverse proxy rules that inspect the start_date and end_date query parameters for HTML metacharacters and known XSS payload signatures.
Search historical HTTP logs for GET /thumbnails-regenerate.php requests containing %3C, %22, onerror=, or <script in the query string.
Correlate suspicious requests with subsequent privileged actions in ProjectSend audit logs to identify successful exploitation attempts.

Monitoring Recommendations

Alert on any modification of ProjectSend user accounts, permissions, or global settings that lacks a matching interactive administrator session.
Monitor outbound requests from administrator browsers to unknown domains that could indicate cookie exfiltration.
Track error and 4xx spikes on thumbnails-regenerate.php that may indicate payload probing.

How to Mitigate CVE-2026-53992

Immediate Actions Required

Update ProjectSend to a version that includes commit b4ad95b1bd3d18b23261b7c3496bfbac8ebfe324 applying htmlspecialchars() to the affected parameters.
Restrict administrative access to thumbnails-regenerate.php to trusted networks or VPN ranges until patching is complete.
Rotate session cookies and administrator credentials if suspicious requests to the endpoint are found in logs.

Patch Information

The upstream fix is committed to the ProjectSend repository. See GitHub Commit b4ad95b and the GitHub ProjectSend Repository for release builds. Technical detail is documented in the VulnCheck Security Advisory.

Workarounds

Deploy a WAF rule that blocks or strips HTML metacharacters (<, >, ", ') in the start_date and end_date query parameters of requests to thumbnails-regenerate.php.
Set the HttpOnly and SameSite=Strict flags on ProjectSend session cookies to limit cookie theft and cross-site delivery of the payload.
Enforce a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Example ModSecurity rule blocking XSS payloads in the affected parameters
SecRule REQUEST_URI "@contains /thumbnails-regenerate.php" \
    "id:1005392,phase:2,deny,status:403,log,\
    msg:'CVE-2026-53992 ProjectSend XSS attempt',\
    chain"
    SecRule ARGS:start_date|ARGS:end_date "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
        "t:none,t:urlDecodeUni"