---METADATA---
VENDOR: Cudy
PRODUCT: LT300
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in the Cudy LT300 router, potentially allowing unauthorized system access.

Executive Summary:
The Cudy LT300 router contains a high-severity security flaw that poses a significant risk of unauthorized system compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2026-32833

Affected Software: Cudy LT300

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Cudy LT300 router, potentially allowing an attacker to bypass security controls. Given the nature of router-based flaws, this typically impacts the device's management interface, likely requiring network-level access to exploit.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the network gateway, enabling attackers to intercept traffic, modify network configurations, or pivot into internal segments. With a CVSS score of 8.8, this represents a high risk to organizational data integrity and network confidentiality.

Remediation Plan

Immediate Action: Check the official Cudy support portal immediately for firmware updates and apply the latest security patches to all deployed units.

Proactive Monitoring: Monitor network traffic for unusual administrative login attempts or unauthorized modifications to router configuration settings.

Compensating Controls: Restrict access to the router’s administrative management interface to trusted internal IP addresses or a dedicated management VLAN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the LT300 as a network gateway, immediate remediation is required. Administrators should verify the current firmware version against the vendor's security advisory and prioritize patching to prevent unauthorized access to the network infrastructure.

---METADATA---
VENDOR: datacycle-engine
PRODUCT: dataCycle-CORE
AFFECTED_VERSIONS: <= 25.07.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The dataCycle-CORE management system contains an improper authorization vulnerability that allows authenticated users to perform unauthorized data management operations.

Executive Summary:
An improper authorization vulnerability in dataCycle-CORE allows authenticated users to access or manipulate data they are not authorized to interact with.

Vulnerability Details

CVE-ID: CVE-2026-32821

Affected Software: dataCycle-CORE

Affected Versions: <= 25.07.3

Vulnerability: This is an improper authorization vulnerability (CWE-285). While the attacker must be authenticated, the system fails to verify if the user possesses the necessary permissions to execute specific data management tasks.

Business Impact

The CVSS score of 8.1 indicates a high risk to data confidentiality and integrity. An attacker with standard user access could escalate their impact by accessing or modifying sensitive data managed by the system, leading to potential data breaches and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Update dataCycle-CORE to the latest version provided by the vendor to ensure proper authorization checks are enforced.

Proactive Monitoring: Audit user access logs to identify suspicious patterns of data modification or unauthorized attempts to access restricted project folders.

Compensating Controls: Apply the principle of least privilege by restricting user access to only the specific data stores required for their role until the patch is implemented.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed exploitation in the wild.

Analyst Recommendation

Because this vulnerability allows authenticated users to bypass authorization controls, it should be treated with urgency. Administrators must update the application immediately to ensure that data access policies are correctly enforced across all user levels.

---METADATA---
VENDOR: Admidio
PRODUCT: Admidio User Management
AFFECTED_VERSIONS: 5.0.0 through 5.0.6
---END_METADATA---

Description Summary:
Admidio versions 5.0.0 through 5.0.6 fail to validate delete permissions and CSRF tokens in the documents module, allowing unauthenticated or low-privileged users to delete files.

Executive Summary:
A critical vulnerability in Admidio's document management module allows unauthenticated or unauthorized users to permanently delete the entire document library through manipulated HTTP requests.

Vulnerability Details

CVE-ID: CVE-2026-32817

Affected Software: Admidio User Management

Affected Versions: 5.0.0 through 5.0.6

Vulnerability: The application fails to perform proper authorization checks for file and folder deletion, only verifying view-level access. Furthermore, the lack of CSRF protection allows an unauthenticated attacker to trigger deletions via simple GET requests if the module is in public mode.

Business Impact

This vulnerability poses a significant risk to data availability and business continuity. An attacker can achieve a total denial of service for the document library by wiping all files. For organizations relying on Admidio for user management and document storage, this could lead to the permanent loss of sensitive records and significant reputational damage. The CVSS score of 9.1 reflects this high impact on availability.

Remediation Plan

Immediate Action: Upgrade Admidio to version 5.0.7 immediately to introduce proper permission validation and CSRF protection for the documents module.

Proactive Monitoring: Review web server logs for suspicious GET requests targeting modules/documents-files.php with folder_delete or file_delete actions.

Compensating Controls: If immediate updates are not possible, disable the "Documents and Files" module or set documents_files_module_enabled to 0 in the application configuration.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the simplicity of the exploit—requiring only a basic HTTP GET request—makes it highly likely to be targeted.

Analyst Recommendation

The ability for unauthenticated users to destroy a document library is a critical security failure. Administrators must apply the version 5.0.7 patch immediately. Ensure that backups of the document library are verified and stored securely to mitigate the impact of potential data loss incidents.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan Knowledge Management System
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.

Executive Summary:
A critical authorization bypass vulnerability in SiYuan allows any authenticated user, including those with restricted permissions, to execute arbitrary SQL commands and potentially compromise the entire application database.

Vulnerability Details

CVE-ID: CVE-2026-32767

Affected Software: SiYuan Knowledge Management System

Affected Versions: 3.6.0 and below

Vulnerability: This flaw exists in the /api/search/fullTextSearchBlock endpoint when the method parameter is set to 2. An authenticated attacker with "Reader" role privileges can bypass security middleware to inject raw SQL statements directly into the SQLite database.

Business Impact

A successful exploit grants an attacker full control over the application's data layer. This results in total loss of data confidentiality, integrity, and availability, as an attacker can exfiltrate, modify, or delete all stored knowledge and system tables. The CVSS score of 9.8 reflects the critical nature of this flaw, where a low-privileged user can cause catastrophic system-wide impact.

Remediation Plan

Immediate Action: Administrators must upgrade SiYuan to version 3.6.1 or later immediately to apply the necessary authorization and read-only checks to the affected endpoint.

Proactive Monitoring: Review application logs for unusual activity involving the /api/search/fullTextSearchBlock endpoint, specifically looking for SQL syntax or the use of method=2 by non-admin users.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses and consider implementing a Web Application Firewall (WAF) to filter for common SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation by any authenticated user and the critical impact on data integrity, the potential for internal or external exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it completely bypasses the application's security model. Organizations using SiYuan should prioritize the update to version 3.6.1. Failure to remediate this flaw leaves the entire knowledge base vulnerable to unauthorized manipulation or permanent deletion by any user with basic access.

---METADATA---
VENDOR: FreeScout
PRODUCT: FreeScout
AFFECTED_VERSIONS: 1.8.208 and below
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FreeScout versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) via unsanitized email notification templates, allowing unauthenticated attackers to execute arbitrary scripts.

Executive Summary:
A critical Stored XSS vulnerability in FreeScout allows unauthenticated attackers to conduct session hijacking and account takeover by injecting malicious payloads into email notifications.

Vulnerability Details

CVE-ID: CVE-2026-32754

Affected Software: FreeScout

Affected Versions: 1.8.208 and below

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability originating from the improper sanitization of incoming email bodies within the Laravel framework. An unauthenticated attacker can inject malicious HTML or JavaScript that executes when viewed by an agent or administrator, leading to credential theft or account takeover.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows attackers to compromise administrative accounts and gain unauthorized access to sensitive help desk communications. Given the CVSS score of 9.3, this flaw represents a critical threat to data confidentiality and integrity, potentially leading to widespread account compromise and reputational damage.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.209 or later immediately to apply the necessary output sanitization.

Proactive Monitoring: Monitor help desk email traffic for unusual patterns and review system logs for suspicious activity originating from external email addresses.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a WAF to filter common XSS payloads in incoming emails.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of exploitation, the potential for malicious activity is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the FreeScout application to version 1.8.209 to mitigate the risk of remote code execution and unauthorized account access.

---METADATA---
VENDOR: GNU
PRODUCT: inetutils (telnetd)
AFFECTED_VERSIONS: Through 2.7
---END_METADATA---

Description Summary:
GNU inetutils telnetd through version 2.7 contains an out-of-bounds write vulnerability in the LINEMODE SLC suboption handler due to missing buffer checks.

Executive Summary:
A critical out-of-bounds write in the GNU telnet daemon allows remote attackers to potentially execute arbitrary code or cause a denial of service on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-32746

Affected Software: GNU inetutils (telnetd)

Affected Versions: Through 2.7

Vulnerability: The add_slc function in the telnet daemon does not verify if the internal buffer is full before writing data during the Set Local Characters (SLC) negotiation. This allows a remote, unauthenticated attacker to overflow the buffer and overwrite adjacent memory locations.

Business Impact

Because telnetd often runs with elevated privileges, an out-of-bounds write can lead to full system compromise. The CVSS score of 9.8 indicates a high degree of exploitability and impact. Successful exploitation could result in unauthorized access to legacy systems, data theft, or persistent presence within the network environment.

Remediation Plan

Immediate Action: Disable the telnet service immediately and migrate to secure alternatives like SSH. If telnet must be used, apply the latest security patches from the GNU project.

Proactive Monitoring: Audit system logs for crashes in the telnetd process and monitor network traffic for unusual telnet negotiation sequences.

Compensating Controls: Use network isolation or VPNs to restrict telnet access to trusted administrative hosts only, and employ an Intrusion Detection System (IDS) to flag malformed telnet packets.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in core networking utilities like inetutils are frequently targeted once disclosed.

Analyst Recommendation

The use of telnet is generally discouraged due to its lack of encryption. This vulnerability provides a critical reason to finally decommission any remaining telnet infrastructure. If decommissioning is not possible, the GNU inetutils package must be updated to a patched version immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow vulnerability exists in libheif due to improper memory handling, potentially allowing arbitrary code execution via a specially crafted HEIF or AVIF file.

Executive Summary:
A heap-based buffer overflow in the libheif library exposes systems to potential remote code execution through malicious image file processing.

Vulnerability Details

CVE-ID: CVE-2026-32741

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) occurring during the decoding of HEIF/AVIF image formats. The flaw can be triggered by an unauthenticated user providing a maliciously crafted image file to an application utilizing the affected library.

Business Impact

The exploitation of this vulnerability could lead to arbitrary code execution, resulting in full system compromise, loss of data confidentiality, and potential service disruption. With a CVSS score of 7.1, this represents a significant risk to any environment that relies on libheif for image processing, as attackers may leverage this to gain unauthorized access to underlying host systems.

Remediation Plan

Immediate Action: Update the libheif library to version 1.22.0 or later immediately to incorporate the necessary memory safety patches.

Proactive Monitoring: Monitor system logs for unexpected crashes or errors in applications that handle HEIF or AVIF image files, which may indicate exploitation attempts.

Compensating Controls: Implement file-type validation and sandboxing for image processing services to isolate potential memory corruption events from the broader system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability in the wild. However, given the nature of memory corruption flaws, the potential for exploitation is high, and immediate patching is strongly recommended.

Analyst Recommendation

Given the severity of heap-based buffer overflows, organizations should prioritize updating all instances of libheif. Failure to patch allows a vector for remote code execution, which could be catastrophic if the library is integrated into public-facing web services or media processing pipelines.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in libheif allows attackers to perform memory corruption, potentially leading to system instability or arbitrary code execution via malicious image files.

Executive Summary:
An out-of-bounds write vulnerability in libheif poses a severe risk of memory corruption and potential system compromise when processing malformed HEIF/AVIF files.

Vulnerability Details

CVE-ID: CVE-2026-32740

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This vulnerability involves an out-of-bounds write (CWE-787) within the libheif decoder. An unauthenticated attacker can exploit this by submitting a specially crafted image file, causing the application to write data outside of intended memory boundaries.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high risk of total system impact. Successful exploitation could allow an attacker to overwrite critical memory, leading to privilege escalation or unauthorized code execution, which may result in severe operational downtime and data breaches.

Remediation Plan

Immediate Action: Upgrade to libheif version 1.22.0 or later to remediate the out-of-bounds write defect.

Proactive Monitoring: Review application performance metrics and error logs for signs of memory exhaustion or segmentation faults that could indicate an attempt to trigger this write-related flaw.

Compensating Controls: Utilize memory-safe execution environments or restrict file processing to low-privilege service accounts to limit the blast radius of a potential exploitation event.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, the technical impact is rated as total, necessitating urgent attention from security teams.

Analyst Recommendation

The high CVSS score reflects the dangerous nature of out-of-bounds write vulnerabilities. Security teams must ensure all software dependencies using libheif are identified and patched to version 1.22.0 immediately to prevent unauthorized memory manipulation and potential system takeover.

---METADATA---
VENDOR: ApostropheCMS
PRODUCT: @apostrophecms/import-export
AFFECTED_VERSIONS: Prior to version 3.5.3
---END_METADATA---

Description Summary:
A "Zip Slip" path traversal vulnerability in the ApostropheCMS import-export module allows authenticated users with content modification permissions to write arbitrary files to the host filesystem.

Executive Summary:
A critical Zip Slip vulnerability in ApostropheCMS allows authenticated editors to overwrite system files and achieve remote code execution by uploading malicious archives.

Vulnerability Details

CVE-ID: CVE-2026-32731

Affected Software: ApostropheCMS @apostrophecms/import-export

Affected Versions: Prior to version 3.5.3

Vulnerability: The extract() function in gzip.js uses path.join() without sanitizing ../ segments in tar entry names. This allows an authenticated user with "Global Content Modify" permissions to upload a .tar.gz file that writes content to any path accessible by the Node.js process.

Business Impact

This vulnerability is assigned a CVSS score of 9.9. While it requires authentication, the "Global Content Modify" role is commonly held by many staff members. A successful exploit allows for host-level code execution, permanent data loss via file overwriting, and full server compromise, leading to total operational disruption.

Remediation Plan

Immediate Action: Update the @apostrophecms/import-export package to version 3.5.3 or higher immediately.

Proactive Monitoring: Review CMS upload logs for .tar.gz files and audit the filesystem for any unexpected files created in system directories or application source folders.

Compensating Controls: Ensure the Node.js process runs with the least possible filesystem privileges and implement a WAF to inspect archive contents if possible, though patching is the only reliable fix.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation. Zip Slip is a well-documented vulnerability class, making this an easy target for malicious insiders or compromised editor accounts.

Analyst Recommendation

Given the CVSS score of 9.9, this is the most critical vulnerability in this batch. Organizations must update their ApostropheCMS dependencies immediately to prevent a catastrophic compromise of the host environment.

---METADATA---
VENDOR: SciTokens
PRODUCT: SciTokens (Python library)
AFFECTED_VERSIONS: Prior to version 1.9.6
---END_METADATA---

Description Summary:
SciTokens is vulnerable to SQL Injection in its KeyCache class due to the unsafe use of Python's str.format() for query construction, allowing attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in the SciTokens library allows unauthenticated attackers to execute arbitrary database commands, potentially leading to a full compromise of the local SQLite database.

Vulnerability Details

CVE-ID: CVE-2026-32714

Affected Software: SciTokens SciTokens (Python library)

Affected Versions: Prior to version 1.9.6

Vulnerability: The KeyCache class within the SciTokens library fails to properly sanitize user-supplied data, specifically the issuer and key_id fields. By using Python's str.format() to build SQL queries, the application enables an attacker to inject malicious SQL syntax into the local SQLite database environment.

Business Impact

A successful exploit of this vulnerability could result in unauthorized data exfiltration, modification, or deletion within the local database. Given the library's role in security token management, this flaw could compromise the integrity of the entire authentication and authorization framework. The CVSS score of 9.8 reflects the high potential for total loss of confidentiality and integrity without requiring high privileges.

Remediation Plan

Immediate Action: Update the SciTokens Python library to version 1.9.6 or later immediately to replace the vulnerable query construction logic with parameterized queries.

Proactive Monitoring: Review application logs for unusual characters or SQL syntax within token-related requests and monitor for unexpected changes to the local SQLite database files.

Compensating Controls: Implement input validation at the application layer to restrict issuer and key_id strings to expected alphanumeric patterns before they reach the library.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the critical role of SciTokens in identity management, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to any application utilizing the SciTokens library for security assertions. Organizations should prioritize the update to version 1.9.6 immediately to mitigate the risk of SQL injection. Failure to patch may allow attackers to bypass security controls by manipulating the underlying token cache.

---METADATA---
VENDOR: OpenProject
PRODUCT: OpenProject
AFFECTED_VERSIONS: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1
---END_METADATA---

Description Summary:
The OpenProject Repositories module is vulnerable to a persisted Cross-Site Scripting (XSS) attack due to improper sanitation of filenames within repository commits.

Executive Summary:
A critical persisted XSS vulnerability in OpenProject allows attackers with repository push access to execute malicious scripts in the browsers of project members.

Vulnerability Details

CVE-ID: CVE-2026-32703

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: The Repositories module fails to properly escape filenames when displaying changesets. An attacker with push access can create a commit containing a filename with malicious HTML/JavaScript, which executes when other project members view the repository's changeset page.

Business Impact

A successful persisted XSS attack can lead to session hijacking, unauthorized actions performed on behalf of project members, and the theft of sensitive project data. Given the CVSS score of 9.0, the risk is severe as it can target high-privilege users, potentially leading to a broader compromise of the OpenProject instance and the data it contains.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 to ensure that filenames are correctly sanitized before being rendered in the web interface.

Proactive Monitoring: Audit repository commit histories for filenames containing suspicious characters, such as <script> tags or unusual HTML entities.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external scripts, providing a secondary layer of defense against XSS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for push access limits the attacker pool to those who already have some level of trust within a project.

Analyst Recommendation

While this vulnerability requires push access, the potential for session hijacking of administrators makes it a critical priority. Organizations should apply the recommended security updates immediately to protect their users from targeted browser-based attacks.

---METADATA---
VENDOR: Builder.io
PRODUCT: Qwik
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Qwik JavaScript framework poses a high risk to web applications, potentially allowing for unauthorized client-side or server-side interactions.

Executive Summary:
A high-severity vulnerability in the Qwik framework could allow attackers to compromise web application performance and user data integrity.

Vulnerability Details

CVE-ID: CVE-2026-32701

Affected Software: Builder.io Qwik

Affected Versions: See vendor advisory for affected versions

Vulnerability: Qwik is affected by a security flaw within its performance-focused rendering or state management logic. The CVSS score of 7.5 indicates that an attacker could potentially exploit this flaw to execute unauthorized actions, though the specific authentication requirements depend on the framework's implementation in a given application.

Business Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS), session hijacking, or the manipulation of application state, resulting in significant reputational damage and loss of user trust. With a CVSS score of 7.5, the risk to web-facing assets is substantial, particularly for organizations relying on Qwik for high-traffic production sites.

Remediation Plan

Immediate Action: Update the Qwik framework to the latest patched version through your package manager (e.g., npm, yarn) immediately.

Proactive Monitoring: Monitor web application firewall (WAF) logs for suspicious patterns targeting framework-specific endpoints or unusual client-side state transitions.

Compensating Controls: Implement a robust Content Security Policy (CSP) to mitigate the impact of potential injection attacks enabled by this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, vulnerabilities in modern JavaScript frameworks are often targeted quickly once a patch is released.

Analyst Recommendation

We recommend an immediate audit of all projects utilizing the Qwik framework and the application of the latest security patches. Developers should prioritize this update to maintain the security posture of their web applications and protect end-user data.

---METADATA---
VENDOR: OpenProject
PRODUCT: OpenProject
AFFECTED_VERSIONS: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1
---END_METADATA---

Description Summary:
OpenProject is vulnerable to an SQL injection via custom field names, which can be leveraged to manipulate git checkout paths and achieve arbitrary Ruby code execution upon application restart.

Executive Summary:
A critical SQL injection and path traversal chain in OpenProject allows authenticated administrators to escalate privileges and execute arbitrary Ruby code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-32698

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: This vulnerability involves an SQL injection within the Cost Report generation feature via unsanitized custom field names. While the initial vector requires administrator privileges, it can be chained with a repository module flaw to write a git repository to an arbitrary path, leading to remote code execution (RCE).

Business Impact

A successful exploit allows for the complete compromise of the OpenProject application and the underlying server infrastructure. Given the CVSS score of 9.1, the risk is critical as it enables attackers to execute arbitrary code, potentially leading to the theft of sensitive project data, intellectual property, and total system downtime. The ability to inject Ruby code signifies a total loss of integrity and confidentiality for the affected environment.

Remediation Plan

Immediate Action: Administrators must immediately upgrade OpenProject installations to versions 16.6.9, 17.0.6, 17.1.3, 17.2.1, or later to patch the underlying injection vulnerabilities.

Proactive Monitoring: Monitor application logs for unusual SQL syntax in Cost Report queries and inspect the filesystem for unauthorized git repository checkouts in non-standard directories.

Compensating Controls: Restrict administrative access to trusted personnel only and implement strict network-level egress filtering to prevent the server from connecting to malicious external git repositories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the potential for full system compromise through RCE, the potential for exploitation is high once the technical details are reverse-engineered.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path from application-level access to host-level code execution. Organizations using OpenProject should prioritize the application of the vendor-provided patches immediately to mitigate the risk of a full-scale server breach.