Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-22600: OpenProject before 16.6.4 can leak internal files via PDF export

CVE-2026-22600 · published 9 months ago

Summary

OpenProject versions earlier than 16.6.4 let an attacker who can upload a fake image attachment read any file the application can access when a PDF report is generated. This could expose configuration data, passwords, or private project information. Update OpenProject to version 16.6.4 or later, or apply the supplied manual fix, to stop the issue.

What to do

Update openproject openproject to version 16.6.4 or later.

Affected software

Vendor	Product	Affected versions
openproject	openproject	< 16.6.4 `cpe:2.3:a:openproject:openproject::::::::`

Original advisory text

OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.

References

https://github.com/opf/openproject/releases/tag/v16.6.4 URL
https://github.com/opf/openproject/security/advisories/GHSA-m8f2-cwpq-vvhh Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22600... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-22600 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published10 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2026-22600 · NVD

CVE-2026-22600 · OSV

GHSA-m8f2-cwpq-vvhh · GHSA

Track software like this

Free during beta