PT-2026-2220 · Unknown · Imagemagick+1

Jason Beck + 2 · Publicado 2026-01-10 · Atualizado 2026-01-15 · CVE-2026-22600

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.4

Description OpenProject is a web-based project management software. A Local File Read issue exists in the work package PDF export functionality. By uploading a specially crafted SVG file disguised as a PNG as a work package attachment, an attacker can exploit the backend image processing engine, ImageMagick. When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access, such as /etc/passwd, project configuration files, and private project data. The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package.

Recommendations Upgrade to version 16.6.4 or later. If upgrading is not possible, apply the patch manually.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-22600

GHSA-M8F2-CWPQ-VVHH

Produtos afetados

Imagemagick

Openproject

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22600.json · Exploit
• https://github.com/opf/openproject/releases/tag/v16.6.4 · Nota
• https://github.com/opf/openproject/security/advisories/GHSA-m8f2-cwpq-vvhh · Correção
• https://twitter.com/EdmonS02/status/2010290712664060120 · Publicação no Twitter
• https://t.me/cveNotify/148327 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2009802614674698677 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2009817270600532175 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22600 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2010356831676403833 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2009812700126498857 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2009953751834988823 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22600 · Aviso do Fabricante
• https://t.me/CVEtracker/41896 · Publicação no Telegram
• https://twitter.com/cracbot/status/2011755295572443533 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009846296899879309 · Publicação no Twitter