CVE-2026-22601: OpenProject RCE Vulnerability

CVE-2026-22601 Overview

OpenProject is an open-source, web-based project management software. A command injection vulnerability exists in OpenProject versions 16.6.1 and below that allows a registered administrator to execute arbitrary commands on the underlying server. The vulnerability is exploited by configuring a malicious sendmail binary path in the application settings and subsequently triggering a test email, which executes the attacker-specified binary.

Critical Impact

Authenticated administrators can achieve full command execution on the server hosting OpenProject, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• OpenProject version 16.6.1 and below
• OpenProject installations using sendmail for email delivery
• Self-hosted OpenProject deployments with administrative access

Discovery Timeline

• 2026-01-10 - CVE-2026-22601 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22601

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), which occurs when user-controllable input is improperly incorporated into operating system commands. In the context of OpenProject, the application allows administrators to configure the path to the sendmail binary used for email delivery. However, this configuration path is not properly validated or sanitized before being passed to the underlying operating system for execution.

When an administrator configures a malicious path—such as a path to a shell script or an arbitrary executable—and then initiates a test email through the application interface, OpenProject attempts to invoke the configured binary. This results in arbitrary command execution with the privileges of the OpenProject application process.

The network-accessible nature of this vulnerability combined with the potential for complete system compromise makes it particularly dangerous in enterprise environments where OpenProject may be deployed on servers containing sensitive project data.

Root Cause

The root cause of this vulnerability lies in insufficient input validation on the sendmail binary path configuration parameter. The application trusts administrator-supplied input without verifying that the path points to a legitimate sendmail executable or without restricting execution to known-safe binaries. This trust assumption fails when dealing with insider threats or compromised administrator credentials.

Attack Vector

The attack requires authentication as an administrator within OpenProject. An attacker with administrator credentials navigates to the email configuration settings, modifies the sendmail binary path to point to a malicious script or binary, and then triggers the "test email" functionality. The application executes the attacker-controlled path, resulting in command execution on the server.

This attack can be leveraged for initial access if administrator credentials are obtained through phishing or credential stuffing, or as a privilege escalation vector if an attacker already has limited access to the system. The exploitation mechanism involves manipulating the sendmail configuration to specify a malicious executable path, then triggering email functionality to execute the payload. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-22601

Indicators of Compromise

• Unexpected modifications to email delivery configuration settings in OpenProject
• Changes to the sendmail binary path in application configuration files or database
• Unusual process execution originating from the OpenProject application process
• Test email requests followed by anomalous system activity or process spawning

Detection Strategies

• Monitor OpenProject application logs for changes to email configuration settings by any user
• Implement file integrity monitoring on the OpenProject configuration directory
• Configure process monitoring to detect child processes spawned by the OpenProject web application
• Audit administrative actions within OpenProject, particularly configuration changes

Monitoring Recommendations

• Enable detailed audit logging for all administrative actions within OpenProject
• Configure SIEM alerts for configuration changes to email delivery settings
• Monitor for unexpected network connections originating from the OpenProject server
• Implement user behavior analytics to detect anomalous administrative activity

How to Mitigate CVE-2026-22601

Immediate Actions Required

• Upgrade OpenProject to version 16.6.2 or later immediately
• Review recent administrative configuration changes for suspicious sendmail path modifications
• Audit administrator accounts for signs of compromise or unauthorized access
• Restrict administrative access to trusted personnel only

Patch Information

OpenProject has released version 16.6.2 which addresses this command injection vulnerability. The patch is available through the official GitHub release. Organizations should prioritize this update for all production OpenProject deployments.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-9vrv-7h26-c7jc.

Workarounds

• Use SMTP for email delivery instead of sendmail to avoid the vulnerable code path
• Implement network segmentation to limit the impact of potential command execution
• Deploy additional access controls around OpenProject administrative functionality
• Consider read-only filesystem configurations for OpenProject application directories

# Configuration example - Use SMTP instead of sendmail
# In config/configuration.yml or environment variables:
OPENPROJECT_EMAIL_DELIVERY_METHOD=smtp
OPENPROJECT_SMTP_ADDRESS=smtp.example.com
OPENPROJECT_SMTP_PORT=587
OPENPROJECT_SMTP_AUTHENTICATION=plain