Cross-Site Scripting Vulnerability in OpenProject Project Management Software
CVE-2026-32703

9.1CRITICAL

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
18 March 2026

What is CVE-2026-32703?

In OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, a flaw in the Repositories module's handling of filenames allows attackers with push access to create deceptive commits with HTML code. This lack of proper filename sanitization can lead to persistent XSS attacks, affecting all project members who view the repositories page. Malicious codes incorporated into filenames can execute and compromise user security when the changeset containing such a file is accessed.

Affected Version(s)

openproject < 16.6.9 < 16.6.9

openproject >= 17.0.0, < 17.0.6 < 17.0.0, 17.0.6

openproject >= 17.1.0, < 17.1.3 < 17.1.0, 17.1.3

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.