CVE-2025-24892: OpenProject Group Management XSS Vulnerability

CVE-2025-24892 Overview

CVE-2025-24892 is a stored cross-site scripting (XSS) vulnerability in OpenProject, an open-source web-based project management platform. Versions prior to 15.2.1 fail to sanitize user input before rendering it in the Group Management section. An authenticated attacker can create a group whose name contains HTML <script> tags, and those tags execute in the browser of any user who views a project referencing that group. OpenProject 15.2.1 resolves the flaw, and administrators unable to upgrade can apply the upstream patch manually. The weakness is categorized under CWE-79.

Critical Impact
A low-privileged authenticated user can inject persistent JavaScript that runs in other users' sessions, enabling session theft, forced actions, or data leakage within the OpenProject UI.

Affected Products

OpenProject versions prior to 15.2.1
Self-hosted OpenProject deployments exposing the Group Management feature
Enterprise and Community editions built from the opf/openproject source tree

Discovery Timeline

2025-02-10 - CVE-2025-24892 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24892

Vulnerability Analysis

The flaw is a stored XSS in the Group Management workflow. OpenProject accepts a group name during creation but does not HTML-escape that value before writing it into project views that display group membership. When another user loads a project associated with the malicious group, the browser parses the injected markup and executes attacker-controlled JavaScript in the context of the OpenProject origin.

Exploitation requires an authenticated account with permission to create or rename groups, and it requires a victim to view an affected page. Because the payload is persisted server-side, the impact scope extends to any user who renders the tainted group name, including administrators. Successful execution can expose session cookies not marked HttpOnly, CSRF tokens, or project data reachable through the victim's session.

Root Cause

OpenProject's Group Management rendering path treats group names as trusted display strings rather than untrusted input. Output encoding is missing on the code path that inserts the group name into the project HTML, so raw tags such as <script> reach the DOM intact. The upstream fix in pull request #17783 adds proper escaping before rendering.

Attack Vector

An attacker with group-creation privileges creates a group whose name contains an HTML payload, for example a <script> element that exfiltrates cookies to an attacker-controlled host. The attacker then adds the group to a project. When any authorized user opens that project, the payload executes with the victim's privileges. The GitHub Security Advisory GHSA-mg4q-ghvh-cm2j documents the affected flow.

No verified proof-of-concept code is published. Refer to the OpenProject security advisory for technical details.

Detection Methods for CVE-2025-24892

Indicators of Compromise

Group records in the OpenProject database whose name column contains angle brackets, <script, onerror=, onload=, or javascript: substrings.
Outbound HTTP requests from user browsers to unrecognized domains immediately after loading a project page.
Audit log entries showing group creation or renaming events from non-administrative accounts followed by group assignment to shared projects.

Detection Strategies

Query the OpenProject database for group names matching HTML tag patterns and review historical creation events.
Inspect web server access logs for POST requests to /api/v3/groups or /groups containing URL-encoded HTML in the name parameter.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions originating from project pages.

Monitoring Recommendations

Enable and centralize OpenProject application and audit logs, and alert on group create or update actions performed by non-admin users.
Correlate authentication events with subsequent group management API calls to identify anomalous privilege use.
Track outbound network connections from user workstations to domains not on an OpenProject allowlist during active project sessions.

How to Mitigate CVE-2025-24892

Immediate Actions Required

Upgrade OpenProject to version 15.2.1 or later on all self-hosted instances.
Audit existing groups for HTML or JavaScript content in the name field and rename or remove offending entries.
Rotate session cookies and force reauthentication for users who may have viewed tainted project pages.
Restrict group creation and editing permissions to trusted administrative roles until patching is complete.

Patch Information

OpenProject resolved the issue in version 15.2.1. The fix is available in pull request #17783 and can be applied manually using the patch diff for environments that cannot upgrade immediately. See the GitHub Security Advisory GHSA-mg4q-ghvh-cm2j for full remediation guidance.

Workarounds

Apply the upstream patch from opf/openproject PR #17783 directly to the deployed source tree and restart the application.
Deploy a strict Content Security Policy that blocks inline script execution on OpenProject pages.
Place a web application firewall rule in front of OpenProject to reject group creation requests containing <, >, or script tokens in the name parameter.

bash

# Configuration example
# Verify installed OpenProject version and upgrade to 15.2.1 or later
openproject run bundle exec rake db:version
sudo apt-get update && sudo apt-get install --only-upgrade openproject
# Confirm the fixed version is running
openproject config:get OPENPROJECT_VERSION