CVE-2026-32698: Openproject SQL injection (CVSS 9.1)

Description

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredHigh

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

Openproject≥ 17.0.0 < 17.0.6 · ≥ 17.1.0 < 17.1.3 · < 16.6.9 · 17.2.0

Remediation

Fixed in

Openproject≥ 17.0.6

Patch & vendor advisories

https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhx

References

https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhxVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-32698 being actively exploited?

CVE-2026-32698 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.45%.

How severe is CVE-2026-32698?

CVE-2026-32698 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.45% probability of exploitation.

Which products are affected by CVE-2026-32698?

Affected products include Openproject.

How do I fix CVE-2026-32698?

Upgrade affected software to a fixed version, for example Openproject 17.0.6 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-32698 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo