Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2026-22600OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

Critical 9.1

In plain English

A critical-severity information exposure in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 16.6.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

References

https://github.com/opf/openproject/security/advisories/GHSA-m8f2-cwpq-vvhh x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v16.6.4 x_refsource_MISC