SQL Injection Vulnerability in OpenProject by OpenProject Foundation
CVE-2026-34717

9.9CRITICAL

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
2 April 2026

What is CVE-2026-34717?

OpenProject, a popular open-source project management tool, contains a SQL Injection vulnerability in its reporting module prior to version 17.2.3. This issue arises from the improper handling of user input, allowing attackers to manipulate SQL queries through unsanitized input in the WHERE clauses. Users are advised to update to version 17.2.3 or later to mitigate the risk associated with this vulnerability.

Affected Version(s)

openproject < 17.2.3

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v17.2.3
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.