Local File Read Vulnerability in OpenProject by OpenProject
CVE-2026-22600

9.1CRITICAL

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
10 January 2026

What is CVE-2026-22600?

OpenProject, an open-source project management software, has a Local File Read vulnerability in its work package PDF export functionality. This issue affects versions prior to 16.6.4. By uploading a specially crafted SVG file disguised as a PNG, an attacker can exploit the application’s backend image processing engine, ImageMagick. Once the work package is exported to PDF, the image processing attempts to resize the uploaded file, inadvertently allowing the attacker to read arbitrary local files accessible to the application user. This includes sensitive data such as system configuration files and project-specific information. To mitigate this vulnerability, users are encouraged to upgrade to version 16.6.4 or apply the patch manually if unable to upgrade.

Affected Version(s)

openproject < 16.6.4

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v16.6.4
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.