What is the CVSS score of CVE-2026-24685?

CVE-2026-24685 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openproject are affected by CVE-2026-24685?

OpenProject instances running versions prior to 16.6.6 and 17.0.2 are vulnerable to arbitrary file write attacks through the repository diff download feature, potentially allowing attackers to create…

How to fix or mitigate CVE-2026-24685?

Within 24 hours: Identify all OpenProject instances in your environment and document their versions. Within 7 days: Implement network segmentation to restrict access to the `/projects/:project_id/repository/diff.diff` endpoint to trusted users only, and deploy WAF rules to block suspicious requests to this endpoint. Within 30 days: Monitor vendor communications for patch availability and prepare for immediate deployment once released; consider upgrading to versions 16.6.6 or 17.0.2 or later when available.

Openproject CVE-2026-24685

HIGH

Command Injection (CWE-77)

2026-01-28 security-advisories@github.com

Denial Of Service Openproject

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 17:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (/projects/:project_id/repository/diff.diff) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.

AnalysisAI

Arbitrary file write in OpenProject versions before 16.6.6 and 17.0.2 allows authenticated users with repository browse permissions to inject malicious git command options via a crafted rev parameter, enabling creation or overwriting of arbitrary files with the privileges of the OpenProject process. An attacker can exploit the /projects/:project_id/repository/diff.diff endpoint to write git show output to attacker-controlled file paths on the server. No patch is currently available for this high-severity vulnerability affecting the open-source project management platform.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Openproject. OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (/projects/:project_id/repository/diff.diff) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the att