opf openproject up to 16.6.6/17.0.2 os command injection

Summaryinfo

A vulnerability has been found in opf openproject up to 16.6.6/17.0.2 and classified as critical. The affected element is an unknown function. Performing a manipulation results in os command injection. This vulnerability was named CVE-2026-25763. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in opf openproject up to 16.6.6/17.0.2. It has been classified as critical. This affects an unknown part. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in OpenProject’s repository changes endpoint (/projects/:project_id/repository/changes) when rendering the “latest changes” view via git log. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git log command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git log output, but by crafting custom commits the attacker can still upload valid shell scripts, ultimately leading to RCE. The RCE lets the attacker create a reverse shell to the target host and view confidential files outside of OpenProject, such as /etc/passwd. This issue has been patched in versions 16.6.7 and 17.0.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-25763 since 02/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Upgrading to version 16.6.7 or 17.0.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-5556). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• opf

Name

• openproject

Version

• 16.6.0
• 16.6.1
• 16.6.2
• 16.6.3
• 16.6.4
• 16.6.5
• 16.6.6
• 17.0.0
• 17.0.1
• 17.0.2

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion