PT-2026-6806 · Unknown · Openproject

Sonntb21Dcat164 · Publicado 2026-02-06 · Atualizado 2026-02-09 · CVE-2026-25764

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.7 OpenProject versions prior to 17.0.3

Description OpenProject is a web-based project management software. A flaw exists in the time tracking function where the application fails to properly handle HTML tags. An attacker possessing administrator privileges can inject HTML through the name field when creating a work package within the Work package section during time tracking. This could lead to the execution of malicious code.

Recommendations Update to OpenProject version 16.6.7 or later. Update to OpenProject version 17.0.3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

CVE-2026-25764

GHSA-Q523-C695-H3HP

Produtos afetados

Openproject

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25764.json · Exploit
• https://github.com/opf/openproject/releases/tag/v17.0.3 · Nota
• https://github.com/opf/openproject/releases/tag/v16.6.7 · Nota
• https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25764 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25764 · Nota de Segurança
• https://t.me/cveNotify/151441 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2019906710538801539 · Publicação no Twitter