Openproject EUVD-2026-12966

Attacker must have OpenProject administrator privileges to create a custom field with malicious SQL payload. When any user generates a Cost Report using that custom field, the SQL injection executes. Affects OpenProject versions <16.6.9, <17.0.6, <17.1.3, <17.2.1.

The CVSS score of 9.1 (Critical) reflects the severity of potential impact with network-based attack vector, low complexity, but requires high privileges (administrator access). The PR:H requirement significantly reduces the attack surface since only users with full administrator privileges can create custom fields necessary for exploitation. However, the Scope:Changed metric indicates potential for broader system compromise beyond the vulnerable component. Without EPSS or KEV data available in the intelligence sources, real-world exploitation likelihood appears moderate due to the privilege prerequisite, but the technical impact is severe given the remote code execution potential through the vulnerability chain. This represents a high priority for organizations where administrator accounts may be compromised or where insider threats are a concern, but lower urgency than internet-facing pre-authentication RCE vulnerabilities.

An attacker with compromised administrator credentials or a malicious insider creates a custom field with a specially crafted name containing SQL injection payloads. When generating a Cost Report that includes this custom field, the SQL injection executes, allowing the attacker to modify project identifier values in the database to include path traversal sequences. The attacker then creates a repository in the affected project, causing OpenProject to checkout a malicious git repository to an arbitrary path within the application directory. Upon the next application restart, the injected Ruby code executes with the privileges of the OpenProject application server, granting full system compromise.