What is the CVSS score of CVE-2026-32703?

CVE-2026-32703 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openproject are affected by CVE-2026-32703?

OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 contain a stored cross-site scripting vulnerability in the Repositories module that allows attackers with repository access to execute…. A patch is available.

How to fix or mitigate CVE-2026-32703?

Within 24 hours: Identify all OpenProject instances and current versions in use. Within 7 days: Apply vendor-released patches-upgrade to OpenProject 16.6.9, 17.0.6, 17.1.3, 17.2.1, or later depending on your current version. Within 30 days: Audit repository access logs for suspicious commits with malicious filenames; reset sessions for all users who accessed affected changesets during the vulnerability window.

Openproject CVE-2026-32703

EUVD-2026-12969 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 GitHub_M

XSS Openproject Opf

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.6.9,17.1.3,17.2.1

EUVD ID Assigned

Mar 18, 2026 - 21:29 euvd

EUVD-2026-12969

Analysis Generated

Mar 18, 2026 - 21:29 vuln.today

CVE Published

Mar 18, 2026 - 21:04 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected in the page without proper sanitation. This allowed a persisted XSS attack against all members of this project that accessed the repositories page to display a changeset where the maliciously crafted file was deleted. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

AnalysisAI

OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying filenames from repository changesets. Attackers with repository push access can inject malicious HTML code via specially crafted filenames, which executes when project members view affected changesets. This affects OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, with a CVSS score of 9.1 indicating critical severity.

Technical ContextAI

The vulnerability affects OpenProject (cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*), an open-source web-based project management platform. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to properly escape or sanitize filenames retrieved from connected repositories before rendering them in the web interface. When the Repositories module displays changeset information, it processes filenames without adequate output encoding, allowing HTML and JavaScript embedded in filenames to be interpreted by browsers. This is a classic stored XSS vulnerability where malicious payloads persist in the repository commit history and execute when other users view the affected changesets.

RemediationAI

Upgrade OpenProject to version 16.6.9, 17.0.6, 17.1.3, or 17.2.1 depending on your release branch. Organizations running version 16.x should upgrade to 16.6.9 or later, those on 17.0.x should upgrade to 17.0.6 or later, those on 17.1.x should upgrade to 17.1.3 or later, and those on 17.2.x should upgrade to 17.2.1 or later. Detailed patching information is available in the GitHub Security Advisory at https://github.com/opf/openproject/security/advisories/GHSA-p423-72h4-fjvp. Until patching is possible, consider restricting repository push access to only highly trusted users, implementing Content Security Policy (CSP) headers to mitigate XSS impact, and educating users not to interact with repository views containing recently added files from untrusted contributors. Review audit logs for suspicious repository commits with unusual filenames that may contain HTML tags or JavaScript code.