Vulnerability details

CVE-2026-32703

opf openproject

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

CVSS 3.1

9.1Critical

Official description

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected in the page without proper sanitation. This allowed a persisted XSS attack against all members of this project that accessed the repositories page to display a changeset where the maliciously crafted file was deleted. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
opf	openproject	< 16.6.9	CVEProject cvelistV5 (CNA)
opf	openproject	>= 17.0.0, < 17.0.6	CVEProject cvelistV5 (CNA)
opf	openproject	>= 17.1.0, < 17.1.3	CVEProject cvelistV5 (CNA)
opf	openproject	>= 17.2.0, < 17.2.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/opf/openproject/security/advisories/GHSA-p423-72h4-fjvp x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-19
Last updated: 2026-03-19
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.19%

Probability of exploitation in 30 days

9.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')