CVE-2026-25763
📋 TL;DR
OpenProject versions before 16.6.7 and 17.0.3 contain an arbitrary file write vulnerability that can lead to remote code execution. Attackers with repository browsing permissions can inject git log options to write files anywhere the OpenProject process can access, potentially uploading malicious scripts. This affects all OpenProject deployments using vulnerable versions.
💻 Affected Systems
- OpenProject
📦 What is this software?
Openproject by Openproject
Openproject by Openproject
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via reverse shell, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Arbitrary file creation/overwrite leading to service disruption, data manipulation, or limited RCE within application context.
If Mitigated
File write limited to non-critical locations if proper file permissions and sandboxing are in place.
🎯 Exploit Status
Exploitation requires authenticated access with repository permissions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.6.7 or 17.0.3
Vendor Advisory: https://github.com/opf/openproject/security/advisories/GHSA-x37c-hcg5-r5m7
Restart Required: Yes
Instructions:
1. Backup your OpenProject installation and database. 2. Update to OpenProject 16.6.7 (for 16.x branch) or 17.0.3 (for 17.x branch). 3. Restart the OpenProject service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Repository Permissions
allTemporarily remove :browse_repository permissions from all users except absolutely necessary administrators
Application Firewall Rules
allBlock access to /projects/*/repository/changes endpoint at web application firewall or reverse proxy level
🧯 If You Can't Patch
- Implement strict file system permissions to limit OpenProject process write access
- Deploy network segmentation to isolate OpenProject from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check OpenProject version via admin interface or by examining package versionCheck Version:
For Docker: docker exec openproject bundle exec rails runner "puts OpenProject::VERSION.to_s"Verify Fix Applied:
Confirm version is 16.6.7 or higher (16.x branch) or 17.0.3 or higher (17.x branch)📡 Detection & Monitoring
Log Indicators:
- Unusual git log commands with --output parameter
- File write operations in unexpected locations by OpenProject process
Network Indicators:
- HTTP POST requests to /projects/*/repository/changes with suspicious rev parameters
SIEM Query:
source="openproject" AND (uri_path="/repository/changes" AND (query="*--output*" OR query="*rev=*"))