CVE-2026-25764

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25764", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.358Z", "datePublished": "2026-02-06T22:10:09.715Z", "dateUpdated": "2026-02-09T15:26:40.309Z"}, "containers": {"cna": {"title": "OpenProject vulnerable to Stored HTML injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.7"}, {"name": "https://github.com/opf/openproject/releases/tag/v17.0.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.3"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.7", "status": "affected"}, {"version": "< 17.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:10:09.715Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3."}], "source": {"advisory": "GHSA-q523-c695-h3hp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:19:16.224354Z", "id": "CVE-2026-25764", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:26:40.309Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25764", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:16.224354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:19:17.029Z"}}], "cna": {"title": "OpenProject vulnerable to Stored HTML injection", "source": {"advisory": "GHSA-q523-c695-h3hp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.7"}, {"status": "affected", "version": "< 17.0.3"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp", "name": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.7", "name": "https://github.com/opf/openproject/releases/tag/v16.6.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/releases/tag/v17.0.3", "name": "https://github.com/opf/openproject/releases/tag/v17.0.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:10:09.715Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25764", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:26:40.309Z", "dateReserved": "2026-02-05T18:35:52.358Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T22:10:09.715Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.7"}, {"status": "affected", "version": "< 17.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "A92A6956-8428-458E-8CDC-87124CB065F1", "versionEndExcluding": "16.6.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "C23460A0-11DE-4F88-A751-5A776EEF6D87", "versionEndExcluding": "17.0.3", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de las versiones 16.6.7 y 17.0.3, una vulnerabilidad de inyecci\u00f3n HTML ocurre en la funci\u00f3n de seguimiento de tiempo de OpenProject. La aplicaci\u00f3n no escapa las etiquetas HTML, un atacante con privilegios de administrador puede crear un paquete de trabajo con el nombre que contiene las etiquetas HTML y a\u00f1adirlo a la secci\u00f3n de Paquetes de trabajo al crear el seguimiento de tiempo. Este problema ha sido parcheado en las versiones 16.6.7 y 17.0.3."}], "id": "CVE-2026-25764", "lastModified": "2026-06-17T10:25:11.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25764", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:19:16.224354Z", "version": "2.0.3"}}]}, "published": "2026-02-06T22:16:12.560", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.7"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:20:10.589666+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to version 16.6.7 or 17.0.3, or later, which includes proper escaping of HTML tags in work\u2011package names used for time tracking.", "Limit administrative privileges to users who must manage work packages, reducing the number of accounts capable of injecting malicious content.", "Implement a review or validation step that ensures HTML is correctly escaped in any user\u2011provided text fields before rendering."], "summary": {"action": "Apply Patch", "impact": "Stored HTML Injection"}, "threat_synthesis": {"affected_systems": "OpenProject built by opf:openproject is affected. Versions earlier than 16.6.7 and earlier than 17.0.3 contain the underlying vulnerability; those releases rely on the time\u2011tracking feature that does not sanitize input.", "description_and_impact": "The flaw allows an administrator to insert arbitrary HTML tags into the name of a work package used in time tracking. Because OpenProject does not escape these tags, the injected code is rendered when other users view the time\u2011tracking list, enabling client\u2011side code execution in the victim\u2019s browser. This can be used to steal session data, deface pages, or serve malware. The weakness is a classic Stored XSS scenario, reflected in CWE\u201180.", "risk_and_exploitability": "The exploit requires administrative access to create a malicious work package; thus the attack surface is limited to privileged users. The CVSS score of 3.5 indicates low overall severity, while the EPSS score of below 1% implies a very low probability of commercial exploitation. The issue is not currently listed in the CISA KEV catalog, suggesting no widespread active weaponized attacks at the time of this assessment. Nonetheless, compromised administrator credentials could facilitate a user\u2011side XSS injection that compromises the integrity and confidentiality of user sessions."}}}}, "created": "2026-02-09T10:50:17.338802+00:00", "updated": "2026-04-17T22:30:29.588651+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}