PT-2026-24719 · Git+2 · Openproject

Dqh1 + 1 · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-30234

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.0

Description OpenProject is a web-based project management software. Before version 17.2.0, an authenticated project member with BCF import permissions could upload a manipulated .bcf archive. The <Snapshot> value within the markup.bcf file could be altered to contain an absolute or traversal local path, such as '/etc/passwd' or '../../../../etc/passwd'. During import, this untrusted <Snapshot> value is used as file.path during attachment processing. This allows for arbitrary file reading (AFR) within the read permissions of the OpenProject application user, as local filesystem content can be read outside the intended ZIP scope.

Recommendations Update to version 17.2.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30234

GHSA-Q8C5-VPMM-XRXV

Affected Products

Openproject

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30234.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30234 · Security Note
• https://twitter.com/CVEnew/status/2032998322168873069 · Twitter Post