HTML Sanitization Flaw in OpenProject Affects Web-Based Project Management Software

CVE-2026-52781

What is CVE-2026-52781?

OpenProject, an open-source web-based project management software, is vulnerable due to a flaw in its HTML sanitizer. This flaw allows attackers to exploit the unrestricted data-* attributes associated with elements. By injecting a data-controller attribute into a work package description, an attacker can mount a controller that fetches malicious attachments. This exploit can lead to the execution of arbitrary Turbo Stream actions, potentially redirecting victims to malicious servers. Users should update to versions 17.3.3 or 17.4.1 to mitigate this risk.

References