CVE-2026-25764

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25764
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25764.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25764
Aliases
  • GHSA-q523-c695-h3hp
Published
2026-02-06T22:10:09.715Z
Modified
2026-02-20T02:46:10.874786Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
OpenProject vulnerable to Stored HTML injection
Details

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25764.json"
}
References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
acbb059c8820da8236cee1f43dc0796d83836259
Fixed
6ae0d8b826afef4ede6fcf2174764bcd77f223b0

Affected versions

v17.*
v17.0.0
v17.0.1
v17.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25764.json"