Skip to main content

Openproject CVE-2026-34717

| EUVDEUVD-2026-18470 CRITICAL
SQL Injection (CWE-89)
2026-04-02 GitHub_M
SQLi Openproject
9.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
Apr 21, 2026 - 01:12 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 21, 2026 - 01:07 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 05:47 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
17.2.3
EUVD ID Assigned
Apr 02, 2026 - 18:15 euvd
EUVD-2026-18470
Analysis Generated
Apr 02, 2026 - 18:15 vuln.today
CVE Published
Apr 02, 2026 - 17:59 nvd
CRITICAL 9.9

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.

AnalysisAI

SQL injection in OpenProject's reporting module allows authenticated attackers to execute arbitrary database queries via the =n operator. Affects all versions prior to 17.2.3. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain valid user credentials
Delivery
Authenticate to OpenProject instance
Exploit
Access reporting module
Install
Craft malicious filter using =n operator
C2
Inject SQL payload into filter value
Execute
Execute arbitrary database queries
Impact
Extract sensitive data or modify records
Step 8
Escalate privileges across application scope
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires authenticated access to the OpenProject instance with permissions to access the reporting module. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk assessment reveals a nuanced threat profile despite the critical CVSS 9.9 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated attacker with low-privilege access to an OpenProject instance navigates to the reporting module and crafts a custom report filter using the equals-not (=n) operator. By injecting SQL metacharacters and commands into the filter value field (for example: ' OR 1=1 UNION SELECT password FROM users --), the attacker bypasses input validation and causes the reporting module to execute arbitrary SQL against the backend database. …
Remediation Upgrade to OpenProject version 17.2.3 immediately, as confirmed by the official release at https://github.com/opf/openproject/releases/tag/v17.2.3 and security advisory GHSA-5rrm-6qmq-2364. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all OpenProject instances and identify those running versions prior to 17.2.3; assess which have internet exposure or are accessible to untrusted internal users. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openproject

View all
CVE-2026-46386 CRITICAL
9.9 Jun 26

Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardco
CVE-2026-52782 CRITICAL
9.9 Jun 26

Cross-project folder hijacking in OpenProject before 17.3.3 and 17.4.1 lets a project-admin abuse an insecure direct obj
CVE-2026-52785 CRITICAL
9.9 Jun 26

SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user
CVE-2026-25763 CRITICAL
9.9 Feb 06

OpenProject has a CVSS 9.9 command injection vulnerability allowing authenticated users to execute OS commands on the pr
CVE-2026-52780 CRITICAL
9.6 Jun 26

Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker wi
CVE-2026-32698 CRITICAL
9.1 Mar 18

OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior

CVE-2026-22600 CRITICAL
9.1 Jan 10

OpenProject (before 16.6.4) has a local file read vulnerability through SVG-based ImageMagick exploitation in the PDF ex
CVE-2026-32703 CRITICAL
9.0 Mar 18

OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying
CVE-2026-24772 HIGH
8.9 Jan 28

Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication toke
CVE-2026-24685 HIGH
8.8 Jan 28

Arbitrary file write in OpenProject versions before 16.6.6 and 17.0.2 allows authenticated users with repository browse

CVE-2026-52784 HIGH
8.8 Jun 26

Privilege escalation in OpenProject before 17.3.3 and 17.4.1 lets an attacker forge a cross-site request to /users/:id c
CVE-2026-23625 HIGH
8.7 Jan 19

Stored XSS in OpenProject versions 16.3.0-16.6.4 allows authenticated users to inject arbitrary HTML/JavaScript through

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2025-57819 CRITICAL POC
10.0
CVE-2024-1698 CRITICAL POC
9.8
CVE-2024-32640 CRITICAL POC
9.8
CVE-2024-8522 CRITICAL POC
10.0
CVE-2024-4434 CRITICAL POC
9.8
CVE-2025-3096 CRITICAL POC
9.3
CVE-2026-21643 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2025-57819 CRITICAL POC
10.0
CVE-2024-1698 CRITICAL POC
9.8
CVE-2024-32640 CRITICAL POC
9.8
CVE-2024-8522 CRITICAL POC
10.0
CVE-2025-1094 HIGH POC
8.1
CVE-2024-4434 CRITICAL POC
9.8
CVE-2025-3096 CRITICAL POC
9.3
CVE-2025-34102 CRITICAL POC
9.3

Share

CVE-2026-34717 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy