CVE-2026-32703: OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not…

PriorityP429medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.19%

8.7th percentile

OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected in the page without proper sanitation. This allowed a persisted XSS attack against all members of this project that accessed the repositories page to display a changeset where the maliciously crafted file was deleted. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
openproject	openproject	< 16.6.9	16.6.9
openproject	openproject	—	—
openproject	openproject	>= 17.0.0 < 17.0.6	17.0.6
openproject	openproject	>= 17.1.0 < 17.1.3	17.1.3
opf	openproject	< 16.6.9	16.6.9
opf	openproject	—	—
opf	openproject	—	—
opf	openproject	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.