OPF vulnerabilities
55 CVEs and advisories name OPF as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-30234OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)
- CVE-2026-27723OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects
- CVE-2026-24777OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts
- CVE-2026-25763Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-25764OpenProject vulnerable to Stored HTML injection
- CVE-2026-24776OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer
- CVE-2026-24775OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension
- CVE-2026-24772OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
- CVE-2026-24685OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-23721OpenProject users with "View Members" permission in any project can view all Group memberships
- CVE-2026-23646OpenProject users can delete other user's session, causing them to be logged out
- CVE-2026-23625OpenProject has stored XSS regression using attachments and script-src self
- CVE-2026-22605OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings
- CVE-2026-22604OpenProject is vulnerable to user enumeration via the change password function
- CVE-2026-22603OpenProject has no protection against brute-force attacks in the Change Password function
- CVE-2026-22602OpenProject is Vulnerable to User Enumeration via User ID
- CVE-2026-22601OpenProject is Vulnerable to Code Execution in E-Mail function
- CVE-2026-22600OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder
- CVE-2025-24892OpenProject stored HTML injection vulnerability
- CVE-2024-41801OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration
- CVE-2024-35224Stored Cross-Site Scripting (XSS) in OpenProject
- CVE-2023-33960OpenProject vulnerable to project identifier information leakage through robots.txt
- CVE-2023-31140OpenProject user sessions not terminated after activation of 2FA
- CVE-2021-43830SQL injection in OpenProject
- CVE-2021-32763Regular Expression Denial of Service in OpenProject forum messages