Local File Read Vulnerability in OpenProject by OpenProject

CVE-2026-22600

What is CVE-2026-22600?

OpenProject, an open-source project management software, has a Local File Read vulnerability in its work package PDF export functionality. This issue affects versions prior to 16.6.4. By uploading a specially crafted SVG file disguised as a PNG, an attacker can exploit the application’s backend image processing engine, ImageMagick. Once the work package is exported to PDF, the image processing attempts to resize the uploaded file, inadvertently allowing the attacker to read arbitrary local files accessible to the application user. This includes sensitive data such as system configuration files and project-specific information. To mitigate this vulnerability, users are encouraged to upgrade to version 16.6.4 or apply the patch manually if unable to upgrade.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References