Description Summary:
A missing authorization vulnerability in OpenProject allows authenticated users to perform unauthorized actions due to improper capability checks.

Executive Summary:
A missing authorization flaw in OpenProject allows authenticated users to perform unauthorized actions, potentially leading to significant data integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-67527

Affected Software: OpenProject OpenProject

Affected Versions: < 17.6.0

Vulnerability: This vulnerability is a missing authorization flaw (CWE-862) that occurs when the application fails to properly verify user permissions before executing sensitive functions. The attack requires the attacker to be an authenticated user with low privileges to exploit the oversight.

Business Impact

Successful exploitation allows an authenticated user to perform actions they are not authorized to execute. Given the CVSS score of 7.6, this represents a high-severity risk to business operations, as it could lead to unauthorized data modification, project manipulation, or escalation of privilege within the project management environment.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 17.6.0 or later to include the required authorization checks.

Proactive Monitoring: Review audit logs for unusual patterns of administrative or unauthorized activity performed by standard user accounts.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies and restrict access to the OpenProject instance to trusted network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the application logic and requires an existing user account to trigger.

Analyst Recommendation

The high CVSS score reflects the potential for serious unauthorized modification of project data. Administrators should prioritize updating to version 17.6.0 immediately to ensure that all internal authorization mechanisms are properly enforced and to prevent potential abuse by malicious internal actors.

Description Summary:
OpenProject contains a SQL injection vulnerability in the timestamps functionality, allowing authenticated attackers to execute arbitrary SQL queries via the timestamps parameter.

Executive Summary:
A critical SQL injection vulnerability in OpenProject enables authenticated attackers to manipulate database queries through the timestamps parameter during baseline comparisons.

Vulnerability Details

CVE-ID: CVE-2026-52785

Affected Software: opf OpenProject

Affected Versions: Prior to 17.3.3 and 17.4.1

Vulnerability: The application fails to properly sanitize the timestamps parameter used in baseline comparisons, allowing an authenticated user to perform SQL injection and potentially access or modify sensitive project data.

Business Impact

With a CVSS score of 9.9, this vulnerability presents a severe risk to data integrity and confidentiality. A successful attack could allow an unauthorized party to bypass application logic, extract private project management data, or potentially gain administrative control over the underlying database, causing significant operational disruption.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 17.3.3 or 17.4.1 immediately to resolve the improper input handling.

Proactive Monitoring: Review database audit logs for unusual query patterns or unexpected error messages indicative of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) configured with SQL injection protection rules to filter malicious payloads directed at the OpenProject application.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability, immediate patching is mandatory. Organizations should ensure that all OpenProject instances are updated to the recommended versions to eliminate the risk of database compromise and unauthorized data access.

Description Summary:
A high-severity vulnerability has been identified in OpenProject, a web-based project management platform, potentially leading to unauthorized data access.

Executive Summary:
The OpenProject management platform is susceptible to a high-severity vulnerability that could allow unauthorized actors to compromise project data and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-52784

Affected Software: OpenProject

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the OpenProject web-based application, potentially exposing sensitive project management data. The flaw resides within the application's core functionality, which may be reachable by an unauthenticated or low-privileged attacker depending on the specific configuration.

Business Impact

Exploitation of this vulnerability threatens the confidentiality of sensitive project documentation and internal communication stored within the platform. With a CVSS score of 8.8, the risk of unauthorized data exfiltration or unauthorized system modification is high, potentially leading to significant operational disruption.

Remediation Plan

Immediate Action: Update the OpenProject instance to the latest stable version provided by the vendor to address the underlying security deficiency.

Proactive Monitoring: Review application access logs for anomalous patterns, such as mass data export requests or unexpected administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious payloads targeting known OpenProject vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the remediation of this vulnerability due to the sensitive nature of information held in project management systems. Apply all available vendor patches immediately and ensure that audit logging is enabled to detect any potential post-exploitation activity.

Description Summary:
A high-severity vulnerability has been disclosed in the OpenProject web-based project management software, requiring urgent administrative intervention.

Executive Summary:
OpenProject is vulnerable to a security flaw that could allow attackers to compromise project management data and gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-52783

Affected Software: OpenProject OpenProject

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the OpenProject platform, affecting its core web-based project management functions. While specific vector details are pending, such flaws in project management tools often involve authorization bypasses or input validation errors.

Business Impact

The CVSS score of 8.2 marks this as a High-severity vulnerability. A successful attack could expose sensitive project documentation, intellectual property, and internal communication, leading to significant business disruption and a loss of trust among stakeholders and clients.

Remediation Plan

Immediate Action: Upgrade the OpenProject instance to the latest patched version immediately upon release by the vendor.

Proactive Monitoring: Monitor web server logs for suspicious traffic patterns, particularly those targeting project management modules or user authentication endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter potentially malicious requests targeting the OpenProject web interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized access to project data, this vulnerability must be addressed urgently. Organizations utilizing OpenProject should verify their current version against vendor security bulletins and implement the necessary patches to maintain a secure project management environment.

Description Summary:
OpenProject contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated project administrators to hijack project folders and overwrite access control lists.

Executive Summary:
An IDOR vulnerability in OpenProject enables authenticated project administrators to perform unauthorized cross-project folder access and data manipulation, warranting a critical severity rating.

Vulnerability Details

CVE-ID: CVE-2026-52782

Affected Software: opf OpenProject

Affected Versions: Prior to 17.3.3 and 17.4.1

Vulnerability: The vulnerability is an IDOR flaw found in the project storage settings. By manipulating the storages_project_storage[project_folder_id] parameter, an attacker with project-admin privileges in one project can hijack the folder storage of a different project, ultimately causing the system to overwrite folder ACLs with the attacker's user list.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a severe threat to data confidentiality and integrity. The ability to hijack storage folders allows an attacker to gain unauthorized access to sensitive project documents or inadvertently restrict legitimate users from their own files, creating a significant risk to organizational project management security.

Remediation Plan

Immediate Action: Upgrade to OpenProject version 17.3.3 or 17.4.1 as specified in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual PATCH requests directed at the project storage settings endpoint.

Compensating Controls: Restrict administrative privileges to trusted personnel and verify folder access permissions until the update can be applied.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability highlights a major failure in cross-project isolation, potentially allowing for internal data leakage or sabotage. Administrators must apply the security patches immediately to restore proper access control boundaries and prevent further risk of unauthorized folder manipulation.

Description Summary:
OpenProject is vulnerable to cache store poisoning, which can be leveraged by attackers to achieve Remote Code Execution on the host system.

Executive Summary:
OpenProject contains a critical cache poisoning vulnerability that can lead to Remote Code Execution, necessitating an immediate software update.

Vulnerability Details

CVE-ID: CVE-2026-52780

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 17.3.3 and 17.4.1

Vulnerability: The application is susceptible to cache store poisoning. By injecting malicious data into the cache, an attacker can manipulate application logic to execute arbitrary code on the server.

Business Impact

The CVSS score of 9.6 underscores the critical nature of this vulnerability. Remote Code Execution allows attackers to bypass all application-level security, potentially leading to a full compromise of the project management platform, theft of sensitive intellectual property, and unauthorized access to integrated systems and databases.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 17.3.3, 17.4.1, or later to address the cache poisoning vulnerability.

Proactive Monitoring: Monitor server logs for unusual cache-related errors or unexpected process spawns that could indicate an attempt to leverage cache poisoning for command execution.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious payloads and limit the exposure of the application's cache-handling interfaces.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to achieve Remote Code Execution through cache poisoning makes this a high-priority vulnerability. Security teams should prioritize patching this instance immediately to prevent potential system-wide compromise. Verify that all instances are running the updated versions and audit access logs for any evidence of prior unauthorized activity.

Description Summary:
A vulnerability has been identified in OpenProject, an open-source project management platform, that may expose the system to unauthorized access or manipulation.

Executive Summary:
OpenProject is affected by a high-severity security vulnerability that could allow unauthorized actors to compromise project management integrity.

Vulnerability Details

CVE-ID: CVE-2026-47193

Affected Software: OpenProject OpenProject

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a security flaw within the OpenProject platform. Due to the lack of granular technical details, administrators should assume this requires authentication or involves a configuration weakness that could lead to unauthorized system access.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high level of risk to organizational data. Successful exploitation could result in the unauthorized modification of project data, exposure of sensitive internal communications, and a potential loss of administrative control over the project management environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of OpenProject as soon as the vendor releases a security patch.

Proactive Monitoring: Review application and system access logs for anomalous login patterns or unauthorized access attempts to project boards.

Compensating Controls: Implement strict network segmentation and ensure the application is not exposed directly to the public internet without a robust Web Application Firewall (WAF).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, this vulnerability poses a significant risk to project management workflows. Organizations should prioritize patching as soon as the vendor provides updated binaries and maintain heightened monitoring until the environment is secured.

Description Summary:
A default, insecure secret key configuration in the official OpenProject Docker image allows authenticated users to achieve remote code execution via Marshal-deserialization of cookies.

Executive Summary:
A critical security misconfiguration in the official OpenProject Docker image exposes users to remote code execution due to the use of a predictable, default Rails master key.

Vulnerability Details

CVE-ID: CVE-2026-46386

Affected Software: OpenProject

Affected Versions: All versions using the vulnerable default Docker image configuration

Vulnerability: The official Docker image ships with a default Rails secret key (SECRET_KEY_BASE=OVERWRITE_ME), which allows authenticated users to forge cookies. Because the application uses :marshal for cookie serialization, this allows an attacker to trigger arbitrary code execution during the deserialization process.

Business Impact

This vulnerability carries a CVSS score of 9.9, reflecting the extreme risk of total system compromise. By leveraging this flaw, an authenticated user can execute arbitrary code on the server hosting the OpenProject application. This grants the attacker full control over the project management environment, facilitating lateral movement, data theft, or complete system takeover.

Remediation Plan

Immediate Action: Update to the latest version of OpenProject and ensure the SECRET_KEY_BASE environment variable is changed to a strong, unique, and securely generated secret.

Proactive Monitoring: Monitor server logs for signs of anomalous process execution or unexpected system-level changes originating from the OpenProject container.

Compensating Controls: Restrict access to the OpenProject instance to trusted networks only and ensure that the application is running with the least privilege necessary within the container environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of a hardcoded, publicly known default secret key makes this an attractive target for attackers, and the risk of exploitation remains critical.

Analyst Recommendation

The reliance on a default, predictable secret key in a production-ready Docker image is a significant security failure. Administrators must immediately rotate their secret keys and update their deployment configurations to ensure the environment is secured against this deserialization attack vector.

Description Summary:
A SQL injection vulnerability in OpenProject's reporting module allows attackers to execute unauthorized database queries via unparameterized user input.

Executive Summary:
OpenProject versions prior to 17.2.3 are vulnerable to a critical SQL injection flaw that could result in total database compromise and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-34717

Affected Software: OpenProject

Affected Versions: Prior to version 17.2.3

Vulnerability: The "=n" operator in the reporting module fails to parameterize user input before embedding it into SQL WHERE clauses. This allows an attacker to inject malicious SQL commands directly into the application's database queries.

Business Impact

SQL injection is a severe threat that can lead to the unauthorized disclosure of sensitive project data, user credentials, and intellectual property. An attacker could potentially modify or delete database records, leading to data loss and significant operational disruption. The CVSS score of 9.9 reflects the near-total impact on data integrity and confidentiality.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 17.2.3 or later immediately to implement the necessary parameterization for SQL queries.

Proactive Monitoring: Review database logs for unusual query patterns or syntax errors that may indicate SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious payloads before they reach the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 2, 2026, no active exploitation has been confirmed. However, SQL injection vulnerabilities are easily discovered by automated vulnerability scanners and are frequently exploited by threat actors.

Analyst Recommendation

Organizations hosting OpenProject must apply the 17.2.3 patch without delay. SQL injection remains one of the most dangerous and commonly exploited vulnerability types; securing the database layer is critical to maintaining the security of the entire project management environment.

Description Summary:
OpenProject versions before 17.3.0 lack rate limiting or lockout protections for 2FA OTP verification, allowing attackers who possess a user password to brute-force TOTP codes and bypass 2FA.

Executive Summary:
A critical authentication vulnerability in OpenProject allows attackers with known user credentials to bypass two-factor authentication via brute-force, leading to unauthorized account access.

Vulnerability Details

CVE-ID: CVE-2026-33667

Affected Software: OpenProject

Affected Versions: opf openproject < 17.3.0

Vulnerability: This vulnerability is an improper restriction of excessive authentication attempts (CWE-307) occurring within the two_factor_authentication module, where the 2FA verification stage lacks rate limiting or account lockout mechanisms for either TOTP or backup codes. The flaw allows an unauthenticated attacker who has obtained a user password to perform an offline-style brute-force attack against the 6-digit TOTP code.

Business Impact

The inability to restrict failed 2FA attempts exposes the organization to full account takeover for any user whose password has been compromised. Given the CVSS score of 7.4, this vulnerability represents a high risk to data confidentiality and integrity, as successful exploitation permits unauthorized access to sensitive project management data and administrative functions within the application.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 17.3.0 or later immediately to implement the required rate limiting and account lockout protections for 2FA verification.

Proactive Monitoring: Monitor authentication logs for high volumes of failed 2FA verification attempts originating from single or multiple IP addresses, which may indicate an ongoing brute-force attempt.

Compensating Controls: If immediate patching is not feasible, implement strict IP-based rate limiting via a Web Application Firewall or reverse proxy to throttle requests to the 2FA verification endpoint.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the TOTP drift window and lack of rate limiting permit a statistically feasible brute-force attack within a reasonable timeframe.

Analyst Recommendation

This vulnerability presents a significant security gap that renders existing 2FA protections ineffective against targeted credential-based attacks. Organizations should prioritize updating their OpenProject instances to version 17.3.0 as the primary method of remediation. Until the update is applied, administrators should review access logs for suspicious authentication patterns and enforce restrictive network access controls to limit the exposure of the authentication interface.

Description Summary:
The OpenProject Repositories module is vulnerable to a persisted Cross-Site Scripting (XSS) attack due to improper sanitation of filenames within repository commits.

Executive Summary:
A critical persisted XSS vulnerability in OpenProject allows attackers with repository push access to execute malicious scripts in the browsers of project members.

Vulnerability Details

CVE-ID: CVE-2026-32703

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: The Repositories module fails to properly escape filenames when displaying changesets. An attacker with push access can create a commit containing a filename with malicious HTML/JavaScript, which executes when other project members view the repository's changeset page.

Business Impact

A successful persisted XSS attack can lead to session hijacking, unauthorized actions performed on behalf of project members, and the theft of sensitive project data. Given the CVSS score of 9.0, the risk is severe as it can target high-privilege users, potentially leading to a broader compromise of the OpenProject instance and the data it contains.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 to ensure that filenames are correctly sanitized before being rendered in the web interface.

Proactive Monitoring: Audit repository commit histories for filenames containing suspicious characters, such as <script> tags or unusual HTML entities.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external scripts, providing a secondary layer of defense against XSS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for push access limits the attacker pool to those who already have some level of trust within a project.

Analyst Recommendation

While this vulnerability requires push access, the potential for session hijacking of administrators makes it a critical priority. Organizations should apply the recommended security updates immediately to protect their users from targeted browser-based attacks.

Description Summary:
OpenProject is vulnerable to an SQL injection via custom field names, which can be leveraged to manipulate git checkout paths and achieve arbitrary Ruby code execution upon application restart.

Executive Summary:
A critical SQL injection and path traversal chain in OpenProject allows authenticated administrators to escalate privileges and execute arbitrary Ruby code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-32698

Affected Software: OpenProject OpenProject

Affected Versions: Prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1

Vulnerability: This vulnerability involves an SQL injection within the Cost Report generation feature via unsanitized custom field names. While the initial vector requires administrator privileges, it can be chained with a repository module flaw to write a git repository to an arbitrary path, leading to remote code execution (RCE).

Business Impact

A successful exploit allows for the complete compromise of the OpenProject application and the underlying server infrastructure. Given the CVSS score of 9.1, the risk is critical as it enables attackers to execute arbitrary code, potentially leading to the theft of sensitive project data, intellectual property, and total system downtime. The ability to inject Ruby code signifies a total loss of integrity and confidentiality for the affected environment.

Remediation Plan

Immediate Action: Administrators must immediately upgrade OpenProject installations to versions 16.6.9, 17.0.6, 17.1.3, 17.2.1, or later to patch the underlying injection vulnerabilities.

Proactive Monitoring: Monitor application logs for unusual SQL syntax in Cost Report queries and inspect the filesystem for unauthorized git repository checkouts in non-standard directories.

Compensating Controls: Restrict administrative access to trusted personnel only and implement strict network-level egress filtering to prevent the server from connecting to malicious external git repositories.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the potential for full system compromise through RCE, the potential for exploitation is high once the technical details are reverse-engineered.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path from application-level access to host-level code execution. Organizations using OpenProject should prioritize the application of the vendor-provided patches immediately to mitigate the risk of a full-scale server breach.

Description Summary:
A vulnerability in the OpenProject synchronization server allows attackers to perform server side request forgery and potentially impersonate users by intercepting and decrypting authentication tokens.

Executive Summary:
A critical authentication and server side request forgery vulnerability in OpenProject 17.0.0 through 17.0.1 allows unauthorized actors to impersonate authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-24772

Affected Software: OpenProject OpenProject

Affected Versions: OpenProject >= 17.0.0, < 17.0.2, openproject/hocuspocus < 17.0.2

Vulnerability: The synchronization server fails to properly validate the backend URL, allowing an attacker to redirect requests and interact with the OpenProject backend using decrypted authentication tokens. This flaw, categorized under CWE-345, requires an attacker to possess an intercepted token and can be triggered by a logged-in user.

Business Impact

The ability for an attacker to impersonate a legitimate user poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.9, this vulnerability could lead to unauthorized access to sensitive project documents and internal administrative functions, potentially resulting in significant data breaches or unauthorized modification of project assets.

Remediation Plan

Immediate Action: Update OpenProject and the hocuspocus container to version 17.0.2 or later immediately.

Proactive Monitoring: Review system and application access logs for unusual outbound requests originating from the synchronization server or unexpected authentication patterns.

Compensating Controls: If patching is not immediately feasible, disable the real time collaboration feature via Settings, Documents, and Real time collaboration, and disable the hocuspocus container to eliminate the attack vector.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of January 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full user impersonation within the project management environment.

Analyst Recommendation

Given the high CVSS severity and the nature of the vulnerability, organizations should prioritize upgrading their OpenProject instances to version 17.0.2. If an immediate update is not possible, the documented workaround of disabling real time collaboration and the hocuspocus container must be implemented to prevent unauthorized access and potential account takeover.

Description Summary:
OpenProject versions 16.3.0 through 16.6.4 contain a stored cross-site scripting vulnerability in the Roadmap view due to improper escaping of user-controlled project names.

Executive Summary:
A stored cross-site scripting vulnerability in OpenProject versions 16.3.0 through 16.6.4 allows authenticated users to execute malicious scripts within the context of the Roadmap view.

Vulnerability Details

CVE-ID: CVE-2026-23625

Affected Software: OpenProject OpenProject

Affected Versions: >= 16.3.0, < 16.6.5

Vulnerability: This is a stored cross-site scripting (CWE-79) vulnerability occurring in the Roadmap view. An authenticated user can inject arbitrary HTML into subproject names, which is rendered without proper sanitization because the application fails to apply necessary security headers during link generation.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of other users, including administrators, potentially leading to unauthorized actions or session hijacking. With a CVSS score of 8.7, this flaw presents a high risk to the confidentiality and integrity of the project management environment.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 16.6.5 or 17.0.0 to incorporate the necessary security header configurations.

Proactive Monitoring: Review web server and application access logs for suspicious input patterns or unexpected script execution attempts within the Roadmap interface.

Compensating Controls: If an immediate upgrade is not feasible, manually configure your proxying web application server to inject the X-Content-Type-Options: nosniff header to mitigate the impact.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is accessible to authenticated users, the requirement for user interaction and specific project configurations limits the immediate exploitability.

Analyst Recommendation

Given the high CVSS severity, organizations should prioritize updating their OpenProject instances to the fixed versions. If an immediate patch cycle is not possible, the implementation of the recommended security headers at the proxy layer is a critical and necessary step to protect against potential script injection attacks.

Description Summary:
A Local File Read vulnerability in OpenProject's PDF export functionality allows authenticated users to read arbitrary files via a malicious SVG attachment processed by ImageMagick.

Executive Summary:
An authenticated local file read vulnerability in OpenProject allows unauthorized access to sensitive system and configuration files, posing a critical risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-22600

Affected Software: OpenProject OpenProject

Affected Versions: < 16.6.4

Vulnerability: This vulnerability occurs in the work package PDF export functionality, where the application improperly processes crafted SVG files using ImageMagick. An authenticated attacker with permissions to upload attachments can trigger the text: coder to read local files accessible to the web application process.

Business Impact

The ability to read arbitrary files, such as configuration files and credentials, provides an attacker with significant reconnaissance data and potentially sensitive project information. Given the CVSS score of 9.1, this vulnerability is critical because it could lead to full system compromise or lateral movement within the network. Unauthorized access to project data may also result in severe reputational damage and the loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade OpenProject to version 16.6.4 or later to apply the necessary patches to the image processing workflow.

Proactive Monitoring: Review application access logs for unusual attachment uploads or repeated PDF export requests that may indicate an attempt to probe the file system.

Compensating Controls: Restrict file upload permissions to trusted users only and implement strict validation on all uploaded image files to ensure they conform to expected formats.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Jan 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on ImageMagick's legacy coder functionality makes this a classic, yet highly effective, path for extracting sensitive data from a server.

Analyst Recommendation

Organizations should treat this vulnerability with high priority due to the severe impact of unauthorized file access. We strongly recommend applying the vendor-provided update to version 16.6.4 immediately to remediate the flaw. If an update cannot be performed, ensure that file upload functionality is restricted and monitored closely to mitigate potential exploitation attempts.