Stored Cross-Site Scripting Vulnerability in OpenProject Project Management Software

CVE-2026-23625

What is CVE-2026-23625?

OpenProject, an open-source web-based project management software, contains a vulnerability in its Roadmap view, affecting versions 16.3.0 to 16.6.4. The issue arises due to the improper handling of project names, allowing user-controlled HTML to be injected into the page without proper escaping. This makes it possible for an attacker to execute malicious scripts within the user's browser session. To mitigate the risk, users are advised to upgrade to versions 16.6.5 or 17.0.0, where protective mechanisms such as the X-Content-Type-Options: nosniff header have been implemented. For installations that cannot be upgraded immediately, it's recommended to manually add this security header in the proxying web application server to enhance protection against exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References