CVE-2026-25764
📋 TL;DR
OpenProject versions before 16.6.7 and 17.0.3 contain an HTML injection vulnerability in the time tracking function. An attacker with administrator privileges can inject HTML tags into work package names, potentially leading to cross-site scripting attacks. This affects all OpenProject installations running vulnerable versions.
💻 Affected Systems
- OpenProject
📦 What is this software?
Openproject by Openproject
Openproject by Openproject
⚠️ Risk & Real-World Impact
Worst Case
Administrator could inject malicious scripts that execute in other users' browsers, potentially stealing session cookies or performing actions on behalf of users.
Likely Case
Limited HTML injection allowing content manipulation or basic phishing attempts within the application interface.
If Mitigated
No impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploitation requires administrator privileges. The vulnerability is straightforward HTML injection without proper escaping.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.6.7 or 17.0.3
Vendor Advisory: https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp
Restart Required: Yes
Instructions:
1. Backup your OpenProject installation and database. 2. Update to OpenProject 16.6.7 (for 16.x branch) or 17.0.3 (for 17.x branch). 3. Restart the OpenProject service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Restriction
allImplement additional input validation to reject HTML tags in work package names
Not applicable - requires code modification
🧯 If You Can't Patch
- Restrict administrator privileges to trusted users only
- Monitor for suspicious HTML content in work package names
🔍 How to Verify
Check if Vulnerable:
Check OpenProject version via admin interface or by examining the installation directory. Versions below 16.6.7 or 17.0.3 are vulnerable.Check Version:
Check OpenProject admin dashboard or run: grep 'version' /path/to/openproject/config/application.rbVerify Fix Applied:
After updating, verify version is 16.6.7 or higher (16.x branch) or 17.0.3 or higher (17.x branch). Test time tracking function with HTML in work package names.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML content in work package creation logs
- Multiple work package creations with special characters
Network Indicators:
- HTTP requests containing HTML tags in work package name parameters
SIEM Query:
source="openproject" AND (work_package.name CONTAINS "<" OR work_package.name CONTAINS ">")