Openproject EUVD-2026-12969

Attacker requires push access to a repository in OpenProject versions prior to 16.6.9, 17.0.6, 17.1.3, or 17.2.1. Victim (project member) must view the Repositories page displaying a changeset with the maliciously crafted filename. Stored XSS persists in repository metadata.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) indicates this is a network-exploitable vulnerability with low attack complexity, requiring low privileges (repository push access) and user interaction (viewing the malicious changeset). The score of 9.1 reflects critical severity, with the changed scope (S:C) indicating attacks can affect resources beyond the vulnerable component. The requirement for authenticated repository access and user interaction does reduce exploitability compared to unauthenticated vulnerabilities. However, in development environments where multiple team members regularly review repository changes, the user interaction barrier is easily satisfied through normal workflows. The stored nature of the XSS means persistence across sessions and automatic triggering when users access the repositories page. No KEV listing or EPSS score is provided in the available data, and no public POC is explicitly mentioned, suggesting limited observed exploitation. The availability of patches in versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 makes this addressable. Real-world risk is elevated for organizations using OpenProject with multiple repository contributors, particularly if the platform hosts sensitive project data or has integration with authentication systems that could be compromised via session hijacking.

An attacker with repository push access creates a commit containing a file with a malicious filename such as '<img src=x onerror=alert(document.cookie)>.txt', then deletes this file in a subsequent commit. When a project administrator or team member navigates to the Repositories page to review recent changesets, the malicious JavaScript executes in their browser context, potentially stealing session cookies, performing actions as the victim user, or exfiltrating sensitive project data. The attack persists in the repository history and affects all users who view the changeset.