PT-2026-24719 · Git+2 · Openproject

Dqh1 + 1 · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-30234

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.0

Description OpenProject is a web-based project management software. Before version 17.2.0, an authenticated project member with BCF import permissions could upload a manipulated .bcf archive. The <Snapshot> value within the markup.bcf file could be altered to contain an absolute or traversal local path, such as '/etc/passwd' or '../../../../etc/passwd'. During import, this untrusted <Snapshot> value is used as file.path during attachment processing. This allows for arbitrary file reading (AFR) within the read permissions of the OpenProject application user, as local filesystem content can be read outside the intended ZIP scope.

Recommendations Update to version 17.2.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30234

GHSA-Q8C5-VPMM-XRXV

Produtos afetados

Openproject

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30234.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-30234 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-30234 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032998322168873069 · Publicação no Twitter