What is the CVSS score of CVE-2026-32703?

CVE-2026-32703 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openproject are affected by CVE-2026-32703?

OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 contain a stored cross-site scripting vulnerability in the Repositories module that allows attackers with repository access to execute…. A patch is available.

How to fix or mitigate CVE-2026-32703?

Within 24 hours: Identify all OpenProject instances and current versions in use. Within 7 days: Apply vendor-released patches-upgrade to OpenProject 16.6.9, 17.0.6, 17.1.3, 17.2.1, or later depending on your current version. Within 30 days: Audit repository access logs for suspicious commits with malicious filenames; reset sessions for all users who accessed affected changesets during the vulnerability window.

Openproject CVE-2026-32703

EUVD-2026-12969 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 GitHub_M

XSS Openproject

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.6.9,17.1.3,17.2.1

EUVD ID Assigned

Mar 18, 2026 - 21:29 euvd

EUVD-2026-12969

Analysis Generated

Mar 18, 2026 - 21:29 vuln.today

CVE Published

Mar 18, 2026 - 21:04 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected in the page without proper sanitation. This allowed a persisted XSS attack against all members of this project that accessed the repositories page to display a changeset where the maliciously crafted file was deleted. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

AnalysisAI

OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying filenames from repository changesets. Attackers with repository push access can inject malicious HTML code via specially crafted filenames, which executes when project members view affected changesets. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker pushes commit with HTML-injected filename

Exploit

Filename displayed unescaped in Repositories page

Execution

XSS payload executes in victim's browser

Impact

Attacker steals session/credentials or performs actions as victim

Access

Attacker pushes commit with HTML-injected filename

Exploit

Filename displayed unescaped in Repositories page

Execution

XSS payload executes in victim's browser

Impact

Attacker steals session/credentials or performs actions as victim

Vulnerability AssessmentAI

Exploitation	Attacker requires push access to a repository in OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, or 17.2.1. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) indicates this is a network-exploitable vulnerability with low attack complexity, requiring low privileges (repository push access) and user interaction (viewing the malicious changeset). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with repository push access creates a commit containing a file with a malicious filename such as '<img src=x onerror=alert(document.cookie)>.txt', then deletes this file in a subsequent commit. When a project administrator or team member navigates to the Repositories page to review recent changesets, the malicious JavaScript executes in their browser context, potentially stealing session cookies, performing actions as the victim user, or exfiltrating sensitive project data. …
Remediation	Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 depending on your release branch. … Detailed patch versions, workarounds, and compensating controls in full report.