CRITICAL🇵🇱 Wersja polska

CVE-2026-24685

CVSS 9.4v4.0pub. 2026-01-28upd. 2026-02-09

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The endpoint `/projects/:project_id/repository/diff.diff` passes the `rev` parameter directly to the `git show` command without proper sanitization. An attacker can supply a carefully crafted `rev` parameter value, such as `--output=/tmp/poc.txt`, which will be interpreted by Git as a command-line option rather than a revision identifier. As a result, Git writes the output (commit metadata and patch) to the path specified by the attacker. The attacker only needs the `:browse_repository` permission in the project to carry out the attack.

Impact

An attacker can create or overwrite arbitrary files accessible to the OpenProject process, which may lead to data integrity loss, application configuration corruption, and denial of service (DoS). If critical configuration or application files are overwritten, complete shutdown of the OpenProject instance is possible.

Mitigation & patch

OpenProject should be updated to version 16.6.6 (for the 16.x branch) or 17.0.2 (for the 17.x branch), in which the vulnerability has been fixed. Until the patch is applied, it is recommended to limit or revoke the `:browse_repository` permission from unauthorized users and disable SCM repository integration functionality if it is not critical.

Who is affected

OpenProject in versions earlier than 16.6.6 (16.x series) and earlier than 17.0.2 (17.x series) with enabled SCM repository support (Git).

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X