CVE-2026-32703

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32703
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32703.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32703
Aliases
  • GHSA-p423-72h4-fjvp
Published
2026-03-18T21:04:16.982Z
Modified
2026-04-10T05:42:25.583225Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
Details

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected in the page without proper sanitation. This allowed a persisted XSS attack against all members of this project that accessed the repositories page to display a changeset where the maliciously crafted file was deleted. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32703.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
494c7a7229d2e0498a2ea6e6b4862f054741b37b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.6.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
acbb059c8820da8236cee1f43dc0796d83836259
Fixed
3e1b0a8218ce497f579bd207be91be682242fb61
Database specific 
{
    "versions": [
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.0.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
bdd71242fc9c7ccb6a7d5bc70fad236dbda69b3e
Fixed
a5cb0dc635eef97a36fa862502960749d8ebc8dc
Database specific 
{
    "versions": [
        {
            "introduced": "17.1.0"
        },
        {
            "fixed": "17.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/opf/openproject
Events
Introduced
6e12af7f2d682fff2418d67ff91fbab00c6a3169
Fixed
28801970691bd8f99592e76fdb99e04e441b7ee6
Database specific 
{
    "versions": [
        {
            "introduced": "17.2.0"
        },
        {
            "fixed": "17.2.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32703.json"