Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/
Security: opf/openproject
Security
SECURITY.md
-
Command Injection on OpenProject repositories leads to Remote Code ExecutionGHSA-x37c-hcg5-r5m7 published
Feb 6, 2026 by oliverguentherCritical -
Stored HTML injection in time tracking module of OpenProjectGHSA-q523-c695-h3hp published
Feb 6, 2026 by oliverguentherLow -
Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor ExtensionGHSA-35c6-x276-2pvc published
Jan 28, 2026 by oliverguentherModerate -
IDOR on MeetingAgendaItems allows cross-project meeting agenda item transferGHSA-p9v8-w9ph-hqmf published
Feb 5, 2026 by oliverguentherModerate -
Argument Injection on Repository Diff allows Arbitrary File Write and Remote Code ExecutionGHSA-74p5-9pr3-r6pw published
Jan 28, 2026 by oliverguentherCritical -
SSRF and CSWSH in Hocuspocus Synchronization ServerGHSA-r854-p5qj-x974 published
Jan 28, 2026 by oliverguentherHigh -
Users can delete other user's session, causing them to be logged outGHSA-w422-xf8f-v4vp published
Jan 19, 2026 by klaustopherModerate -
Users with "View Members" permission in any project can view all Group membershipsGHSA-vj77-wrc2-5h5h published
Jan 19, 2026 by klaustopherModerate -
Stored XSS regression on OpenProject using attachments and script-src selfGHSA-cvpq-cc56-gwxx published
Jan 19, 2026 by klaustopherHigh -
Arbitrary File Read via ImageMagick SVG CoderGHSA-m8f2-cwpq-vvhh published
Jan 9, 2026 by oliverguentherCritical
Learn more about advisories related to opf/openproject in the GitHub Advisory Database