PT-2026-5149 · Unknown · Openproject

Sam91281 · Published 2026-01-28 · Updated 2026-02-09 · CVE-2026-24685

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.6 OpenProject versions prior to 17.0.2

Description OpenProject is a web-based project management software. A file write issue exists in the repository diff download endpoint (/projects/:project id/repository/diff.diff) when rendering a single revision via git show. By providing a crafted rev value, such as rev=--output=/tmp/poc.txt, an attacker can inject git show command-line options. This allows the OpenProject process to execute the SCM command, interpreting the attacker-controlled rev as an option and writing output to a path chosen by the attacker. Any user with the :browse repository permission on the project can create or overwrite arbitrary files the OpenProject process user is permitted to write. Overwriting application or configuration files can lead to data loss and denial of service.

Recommendations Update to OpenProject version 16.6.6 or later. Update to OpenProject version 17.0.2 or later.

Exploit

Fix

DoS

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-24685

GHSA-74P5-9PR3-R6PW

Affected Products

Openproject

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24685.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-74p5-9pr3-r6pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24685 · Security Note
• https://t.me/cveNotify/151453 · Telegram Post
• https://twitter.com/CCBalert/status/2017224437611831595 · Twitter Post
• https://twitter.com/CVEnew/status/2016562111460364432 · Twitter Post
• https://twitter.com/0dayPublishing/status/2016556054461530414 · Twitter Post