CVE-2026-24685: OpenProject Path Traversal Vulnerability

CVE-2026-24685 Overview

CVE-2026-24685 is a critical command injection vulnerability affecting OpenProject, an open-source, web-based project management software. The vulnerability exists in OpenProject's repository diff download endpoint (/projects/:project_id/repository/diff.diff) when rendering a single revision via git show. By supplying a specially crafted rev value, an attacker can inject git show command-line options, leading to arbitrary file write capabilities on the target system.

Critical Impact

Authenticated users with the :browse_repository permission can create or overwrite arbitrary files on the OpenProject server, potentially leading to data loss, configuration tampering, and denial of service.

Affected Products

• OpenProject versions prior to 16.6.6
• OpenProject versions prior to 17.0.2 (for the 17.x branch)

Discovery Timeline

• 2026-01-28 - CVE-2026-24685 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24685

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection). The flaw originates from insufficient input validation in the repository diff download functionality. When a user requests a diff for a specific revision, the application passes user-supplied input directly to the underlying git show command without proper sanitization.

The attack is particularly dangerous because it requires only the :browse_repository permission, which is commonly granted to regular project members. While the written file contents consist of git show output (commit metadata and patch data), the ability to overwrite arbitrary files still enables significant impact on system integrity and availability.

Root Cause

The root cause lies in the improper handling of the rev parameter in the diff download endpoint. The application fails to validate or sanitize the revision parameter before passing it to the git command-line interface. Git interprets strings beginning with -- as command-line options rather than revision identifiers, allowing attackers to inject arbitrary flags including --output= which directs output to a specified file path.

Attack Vector

The attack is network-based and requires low privileges (authenticated user with repository browsing permissions). An attacker crafts a malicious request to the vulnerable endpoint with a specially formatted rev parameter such as rev=--output=/tmp/poc.txt. When OpenProject executes the SCM command, Git interprets this as a command-line option rather than a revision identifier, writing the git show output to the attacker-specified file path.

For example, an attacker could target configuration files, application code, or system files that the OpenProject process user has write access to. Overwriting critical files such as application configurations or database connection settings could result in denial of service or further compromise of the application.

For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-24685

Indicators of Compromise

• Unusual HTTP requests to /projects/*/repository/diff.diff endpoints containing --output= or similar git option patterns in the rev parameter
• Unexpected file creation or modification in directories writable by the OpenProject process user
• Web server access logs showing URL-encoded command-line option characters in repository-related requests
• Anomalous system file changes that correlate with repository access activity

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing command-line option patterns (--) in the rev parameter
• Monitor application logs for requests to the diff download endpoint with suspicious parameter values
• Deploy file integrity monitoring (FIM) on critical system and application directories
• Enable audit logging for file system write operations by the OpenProject process user

Monitoring Recommendations

• Configure alerts for any requests to repository diff endpoints containing shell metacharacters or option-like patterns
• Establish baseline behavior for repository access patterns and alert on anomalies
• Monitor for unexpected changes to configuration files, especially those related to OpenProject and its dependencies
• Review web server access logs regularly for exploitation attempts

How to Mitigate CVE-2026-24685

Immediate Actions Required

• Upgrade OpenProject to version 17.0.2 or 16.6.6 immediately
• Review access logs for evidence of exploitation attempts targeting the vulnerable endpoint
• Audit file system changes on servers running vulnerable versions
• Temporarily restrict access to repository features if immediate patching is not possible

Patch Information

The vulnerability has been fixed in OpenProject versions 17.0.2 and 16.6.6. Organizations should upgrade to these patched versions as soon as possible. The fix implements proper input validation and sanitization for the rev parameter to prevent command-line option injection.

For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Restrict the :browse_repository permission to only trusted users until the patch can be applied
• Deploy a web application firewall rule to block requests containing -- patterns in the rev parameter
• Consider temporarily disabling repository integration features if they are not critical to operations
• Implement network-level access controls to limit who can reach the OpenProject instance

# Example WAF rule pattern for blocking exploitation attempts
# Block requests with command-line option patterns in rev parameter
# Pattern: /repository/diff.diff containing rev=--
SecRule REQUEST_URI "@contains /repository/diff.diff" \
    "chain,id:100001,deny,status:403,msg:'CVE-2026-24685 Exploitation Attempt'"
SecRule ARGS:rev "@rx ^--" ""