CVE-2026-32703

An attacker with write permissions (push access) to a repository creates a commit containing a file whose name includes malicious HTML or JavaScript code. The Repositories module, when displaying the changeset, does not properly escape file names, allowing the embedded code to reach the page without proper sanitization. The malicious script is executed in the browser context of every user who views the repositories page containing the changeset with the deleted, crafted file. This is a persisted (stored) XSS attack, meaning the payload is permanently stored on the server side and activated each time the page is accessed.

An attacker can execute arbitrary JavaScript code in the context of a logged-in user's session, which may lead to theft of session tokens, credentials, and execution of unauthorized actions on behalf of the victim in the OpenProject application. Due to the scope change (Scope:Changed), the attack may also affect resources outside the directly controlled application.

OpenProject should be updated to version 16.6.9, 17.0.6, 17.1.3 or 17.2.1 depending on the branch in use. Until an update is applied, consider restricting push access permissions in repositories to trusted users only and limiting access to the Repositories module. Details are available in the official security advisory: https://github.com/opf/openproject/security/advisories/GHSA-p423-72h4-fjvp

OpenProject versions prior to 16.6.9 (16.x branch), 17.0.6 (17.0.x branch), 17.1.3 (17.1.x branch) and 17.2.1 (17.2.x branch) with the Repositories module enabled.