CVE-2026-30234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30234", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T17:23:59.798Z", "datePublished": "2026-03-11T15:59:11.145Z", "dateUpdated": "2026-03-11T17:18:50.762Z"}, "containers": {"cna": {"title": "OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 17.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T15:59:11.145Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the <Snapshot> value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untrusted <Snapshot> value is used as file.path during attachment processing. As a result, local filesystem content can be read outside the intended ZIP scope. This results in an Arbitrary File Read (AFR) within the read permissions of the OpenProject application user. This vulnerability is fixed in 17.2.0."}], "source": {"advisory": "GHSA-q8c5-vpmm-xrxv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T17:18:40.365382Z", "id": "CVE-2026-30234", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:18:50.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T17:18:40.365382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:18:46.301Z"}}], "cna": {"title": "OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)", "source": {"advisory": "GHSA-q8c5-vpmm-xrxv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.2.0"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv", "name": "https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the <Snapshot> value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untrusted <Snapshot> value is used as file.path during attachment processing. As a result, local filesystem content can be read outside the intended ZIP scope. This results in an Arbitrary File Read (AFR) within the read permissions of the OpenProject application user. This vulnerability is fixed in 17.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T15:59:11.145Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30234", "state": "PUBLISHED", "dateUpdated": "2026-03-11T17:18:50.762Z", "dateReserved": "2026-03-04T17:23:59.798Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T15:59:11.145Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 17.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FB19C4D-0273-43F6-9AF6-3D30795D43BB", "versionEndExcluding": "17.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the <Snapshot> value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untrusted <Snapshot> value is used as file.path during attachment processing. As a result, local filesystem content can be read outside the intended ZIP scope. This results in an Arbitrary File Read (AFR) within the read permissions of the OpenProject application user. This vulnerability is fixed in 17.2.0."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto basado en web. Antes de la versi\u00f3n 17.2.0, un miembro del proyecto autenticado con permisos de importaci\u00f3n de BCF puede cargar un archivo .bcf manipulado en el que el valor del archivo markup.bcf se ha alterado para que contenga una ruta local absoluta o de recorrido (por ejemplo: /etc /passwd o ../../../../etc /passwd). Durante la importaci\u00f3n, este valor no fiable se utiliza como file.path durante el procesamiento de archivos adjuntos. Como resultado, el contenido del sistema de archivos local puede leerse fuera del \u00e1mbito ZIP previsto. Esto da lugar a una lectura arbitraria de archivos (AFR) dentro de los permisos de lectura del usuario de la aplicaci\u00f3n OpenProject. Esta vulnerabilidad se ha corregido en la versi\u00f3n 17.2.0."}], "id": "CVE-2026-30234", "lastModified": "2026-06-17T10:32:32.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30234", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T17:18:40.365382Z", "version": "2.0.3"}}]}, "published": "2026-03-11T16:16:41.383", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q8c5-vpmm-xrxv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,17.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openproject", "source": "cna", "vendor": "opf"}, "product": "openproject", "vendor": "opf"}], "analysis": {"en": {"generated_at": "2026-03-17T17:34:11.939473+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to version 17.2.0 or later", "Restrict BCF import permissions to trusted users to limit potential exploitation"], "summary": {"action": "Apply Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The defect is present in all OpenProject releases prior to version 17.2.0. The software vendor\u2019s CNA lists the affected vendor as opf:openproject, with the product name OpenProject. The vulnerability is fixed in release 17.2.0; any version before that is vulnerable.", "description_and_impact": "The vulnerability enables authenticated users with BCF import permissions to upload a crafted .bcf file containing a &lt;Snapshot&gt; element that specifies an absolute or traversal path. During import, the application uses this untrusted value directly as a file path for attachment processing, allowing the reader to access files outside the intended ZIP scope. Because the attack exploits path traversal (CWE\u201122), it results in an Arbitrary File Read of any file readable by the OpenProject application user, potentially exposing sensitive system configuration or user data.", "risk_and_exploitability": "The CVSS v3.1 base score of 6.5 indicates moderate severity. The EPSS score is below 1%, signalling a low likelihood of exploitation at this time. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires an authenticated project member with BCF import rights; the attacker must create a malicious .bcf archive and upload it to trigger the path traversal. Because the attack is local to the application\u2019s file system, it does not allow remote code execution, but can lead to confidentiality breaches if sensitive files are read."}}}}, "created": "2026-03-12T10:05:34.433454+00:00", "updated": "2026-03-20T15:30:50.275351+00:00", "vendors": ["opf", "opf$PRODUCT$openproject"]}