CVE-2026-25764

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/releases/tag/v16.6.7	Product Release Notes
https://github.com/opf/openproject/releases/tag/v17.0.3	Product Release Notes
https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openproject:openproject::::::::
	cpe:2.3:a:openproject:openproject::::::::

History

No history.

Information

Published : 2026-02-06 22:16

Updated : 2026-02-13 19:04

NVD link : CVE-2026-25764

Mitre link : CVE-2026-25764

CVE.ORG link : CVE-2026-25764

JSON object : View

Products Affected

openproject

openproject

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-25764", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 0.9}]}, "published": "2026-02-06T22:16:12.560", "references": [{"url": "https://github.com/opf/openproject/releases/tag/v16.6.7", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/releases/tag/v17.0.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de las versiones 16.6.7 y 17.0.3, una vulnerabilidad de inyecci\u00f3n HTML ocurre en la funci\u00f3n de seguimiento de tiempo de OpenProject. La aplicaci\u00f3n no escapa las etiquetas HTML, un atacante con privilegios de administrador puede crear un paquete de trabajo con el nombre que contiene las etiquetas HTML y a\u00f1adirlo a la secci\u00f3n de Paquetes de trabajo al crear el seguimiento de tiempo. Este problema ha sido parcheado en las versiones 16.6.7 y 17.0.3."}], "lastModified": "2026-02-13T19:04:45.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A92A6956-8428-458E-8CDC-87124CB065F1", "versionEndExcluding": "16.6.7"}, {"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C23460A0-11DE-4F88-A751-5A776EEF6D87", "versionEndExcluding": "17.0.3", "versionStartIncluding": "17.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}