Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25764OpenProject vulnerable to Stored HTML injection

Low 3.5

In plain English

A low-severity security flaw in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 16.6.7< 17.0.3

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

References

https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hp x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v16.6.7 x_refsource_MISC
https://github.com/opf/openproject/releases/tag/v17.0.3 x_refsource_MISC