CVE-2026-32698

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32698", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T14:33:42.822Z", "datePublished": "2026-03-18T21:01:53.366Z", "dateUpdated": "2026-03-19T14:22:17.046Z"}, "containers": {"cna": {"title": "OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.9", "status": "affected"}, {"version": ">= 17.0.0, < 17.0.6", "status": "affected"}, {"version": ">= 17.1.0, < 17.1.3", "status": "affected"}, {"version": ">= 17.2.0, < 17.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T21:01:53.366Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue."}], "source": {"advisory": "GHSA-jqhf-rf9x-9rhx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T14:22:08.058735Z", "id": "CVE-2026-32698", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:22:17.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-19T14:22:08.058735Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:22:10.972Z"}}], "cna": {"title": "OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution", "source": {"advisory": "GHSA-jqhf-rf9x-9rhx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.9"}, {"status": "affected", "version": ">= 17.0.0, < 17.0.6"}, {"status": "affected", "version": ">= 17.1.0, < 17.1.3"}, {"status": "affected", "version": ">= 17.2.0, < 17.2.1"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx", "name": "https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T21:01:53.366Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32698", "state": "PUBLISHED", "dateUpdated": "2026-03-19T14:22:17.046Z", "dateReserved": "2026-03-13T14:33:42.822Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T21:01:53.366Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.9"}, {"status": "affected", "version": ">= 17.0.0, < 17.0.6"}, {"status": "affected", "version": ">= 17.1.0, < 17.1.3"}, {"status": "affected", "version": ">= 17.2.0, < 17.2.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FD9C4C4-FFDC-4EE6-AAB2-901C1C6CB6BE", "versionEndExcluding": "16.6.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1003FD4-BC22-4AB4-91B4-EB63FFF41C2A", "versionEndExcluding": "17.0.6", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "86B90D5D-1A3D-4524-A3CC-F7B7274A4E26", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:17.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2D1F069-BA78-4F8A-8FF9-DAE63BFB39CF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto, basado en la web. Las versiones anteriores a 16.6.9, 17.0.6, 17.1.3 y 17.2.1 son vulnerables a un ataque de inyecci\u00f3n SQL a trav\u00e9s del nombre de un campo personalizado. Cuando ese campo personalizado se utilizaba en un Informe de Costos, el nombre del campo personalizado se inyectaba en la consulta SQL sin la sanitizaci\u00f3n adecuada. Esto permit\u00eda a un atacante ejecutar comandos SQL arbitrarios durante la generaci\u00f3n de un Informe de Costos. Dado que los campos personalizados solo pueden ser generados por usuarios con privilegios de administrador completos, la superficie de ataque se reduce un poco. Junto con otro error en el m\u00f3dulo Repositories, que utilizaba el identificador del proyecto sin sanitizaci\u00f3n para generar la ruta de extracci\u00f3n para un repositorio git en el sistema de archivos, esto permit\u00eda a un atacante extraer un repositorio git a una ruta elegida arbitrariamente en el servidor. Si la extracci\u00f3n se realiza dentro de ciertas rutas dentro de la aplicaci\u00f3n OpenProject, tras el siguiente reinicio de la aplicaci\u00f3n, esto permite al atacante inyectar c\u00f3digo ruby en la aplicaci\u00f3n. Dado que el identificador del proyecto no puede ser editado manualmente a ninguna cadena que contenga caracteres especiales como puntos o barras, esto necesita ser cambiado a trav\u00e9s de la inyecci\u00f3n SQL descrita anteriormente. Las versiones 16.6.9, 17.0.6, 17.1.3 y 17.2.1 corrigen el problema."}], "id": "CVE-2026-32698", "lastModified": "2026-06-17T10:36:13.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32698", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T14:22:08.058735Z", "version": "2.0.3"}}]}, "published": "2026-03-18T22:16:24.223", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.6.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.1.0,17.1.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.2.0,17.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openproject", "source": "cna", "vendor": "opf"}, "product": "openproject", "vendor": "opf"}], "analysis": {"en": {"generated_at": "2026-03-19T19:23:39.452236+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to at least version 16.6.9 for the 16.x line, 17.0.6 for 17.0.x, 17.1.3 for 17.1.x, or 17.2.1 for 17.2.x releases.", "Verify that the application no longer allows arbitrary custom field names in cost reports after the upgrade.", "If upgrading immediately is not possible, restrict custom field creation to a small set of trusted administrators and disable the Cost Report feature until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "This flaw exists in opf:openproject. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are affected. The CPE stubs show that the vulnerability impacts any release versions called 16.*, 17.0.*, 17.1.*, or 17.2.*, especially since 17.2.0 is listed. The fixes are included in the aforementioned patched releases.", "description_and_impact": "The vulnerability is a classic SQL injection that occurs when the name of a custom field is incorporated directly into a database query used to generate a Cost Report. By injecting malicious SQL through the custom field name, an attacker can execute arbitrary SQL commands against the database. Because the application also includes a second flaw that allows a git repository to be checked out to an arbitrary filesystem location when the project identifier is unsanitized, the attacker can chain these flaws. The first flaw enables the attacker to use the SQL injection to modify the project identifier, and the second flaw allows writing a malicious git repository to a location that, after a server restart, injects Ruby code into the OpenProject application. Together, these issues lead to remote code execution. The primary weakness is identified as CWE-89 (SQL Injection).", "risk_and_exploitability": "The CVSS base score is 9.1, indicating a high severity attack that can compromise confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low probability of exploitation in the near term. The flaw is not in the CISA KEV catalog, implying no known active exploits. The attack vector requires web access to the application and the presence of an administrator who can create a custom field. Therefore, while the exploit could lead to full system compromise, the limited threat surface (only admins can create the vulnerable custom field) reduces the likelihood of success. If an attacker attains administrative rights, chaining the two vulnerabilities provides a straightforward path to remote code execution."}}}}, "created": "2026-03-19T08:55:27.708175+00:00", "updated": "2026-03-25T11:52:10.416543+00:00", "vendors": ["opf", "opf$PRODUCT$openproject"]}