What is the CVSS score of CVE-2026-32698?

CVE-2026-32698 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openproject are affected by CVE-2026-32698?

OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 contain a critical SQL injection vulnerability in Cost Reports that requires administrator access to exploit.. A patch is available.

How to fix or mitigate CVE-2026-32698?

Within 24 hours: Identify all OpenProject instances and document current versions. Within 7 days: Upgrade to patched versions (16.6.9, 17.0.6, 17.1.3, 17.2.1, or later depending on your current release line) and verify successful deployment in production. Within 30 days: Conduct access review of administrator accounts and audit Cost Report usage logs for suspicious activity; implement network segmentation to restrict OpenProject administrator access.

Openproject CVE-2026-32698

EUVD-2026-12966 CRITICAL

SQL Injection (CWE-89)

2026-03-18 GitHub_M

SQLi Openproject

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:50 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

17.2.1,17.1.3,16.6.9

EUVD ID Assigned

Mar 18, 2026 - 21:29 euvd

EUVD-2026-12966

Analysis Generated

Mar 18, 2026 - 21:29 vuln.today

CVE Published

Mar 18, 2026 - 21:01 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

AnalysisAI

OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1. When custom fields are used in Cost Reports, insufficient input sanitization allows attackers with administrator privileges to execute arbitrary SQL commands. This vulnerability can be chained with a path traversal issue in the Repositories module to achieve remote code execution by injecting malicious Ruby code into the application. No current KEV listing or public POC is documented in available sources.

Technical ContextAI

The vulnerability affects OpenProject (CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*), an open-source Ruby on Rails-based project management system. The root cause is CWE-89 (SQL Injection), where custom field names are concatenated directly into SQL queries during Cost Report generation without proper parameterization or escaping. The attack chain leverages this SQL injection to modify project identifiers (normally restricted from containing special characters like dots or slashes), which are then used unsanitized in the Repositories module to construct filesystem paths for git repository checkouts. By controlling the checkout path and placing it within OpenProject's application directory structure, an attacker can inject malicious Ruby code that executes upon application restart.

RemediationAI

Immediately upgrade OpenProject to version 16.6.9 (for 16.x series), 17.0.6 (for 17.0.x series), 17.1.3 (for 17.1.x series), or 17.2.1 (for 17.2.x series) or later as documented in the vendor security advisory at https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx. These patched versions implement proper input sanitization for custom field names and project identifiers. As a temporary mitigation until patching is completed, restrict administrator account access to only highly trusted personnel, implement strict monitoring of custom field creation activities, and review existing custom field names for suspicious content. Additionally, monitor git repository checkout operations and file system changes within the OpenProject application directory for unauthorized modifications.