CRITICAL🇵🇱 Wersja polska

CVE-2026-25763

CVSS 9.4v4.0pub. 2026-02-06upd. 2026-02-13

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in OpenProject’s repository changes endpoint (/projects/:project_id/repository/changes) when rendering the “latest changes” view via git log. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git log command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git log output, but by crafting custom commits the attacker can still upload valid shell scripts, ultimately leading to RCE. The RCE lets the attacker create a reverse shell to the target host and view confidential files outside of OpenProject, such as /etc/passwd. This issue has been patched in versions 16.6.7 and 17.0.3.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The endpoint /projects/:project_id/repository/changes accepts a rev parameter that is passed directly to the git log command without proper sanitization (CWE-78). An attacker can provide a crafted rev value, e.g., rev=--output=/tmp/poc.txt, causing Git to interpret it as a command-line option rather than a revision name. As a result, Git writes the command output to the path specified by the attacker on the server. Through crafted commits in the repository, the attacker can control the content of the written file — including placing an executable shell script — ultimately leading to RCE and the ability to establish a reverse shell connection with the server.

Impact

An attacker with browse_repository permission can create or overwrite any files accessible to the OpenProject process, leading to remote code execution (RCE), server takeover, and access to sensitive system files (e.g., /etc/passwd).

Mitigation & patch

OpenProject should be updated to version 16.6.7 or 17.0.3, in which the vulnerability has been fixed. Patches are available on GitHub: https://github.com/opf/openproject/releases/tag/v16.6.7 and https://github.com/opf/openproject/releases/tag/v17.0.3. Until the update is applied, consider restricting the browse_repository permission only to trusted users.

Who is affected

OpenProject versions earlier than 16.6.7 (16.x branch) and earlier than 17.0.3 (17.x branch) with SCM repository integration (Git) enabled

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X