CVE-2026-25764: OpenProject XSS Vulnerability

CVE-2026-25764 Overview

CVE-2026-25764 is an HTML injection vulnerability affecting OpenProject, the popular open-source, web-based project management software. The vulnerability exists in the time tracking function where the application fails to properly escape HTML tags. An attacker with administrator privileges can create a work package containing malicious HTML tags in the name field and add it to the Work package section when creating time tracking entries.

Critical Impact

Authenticated administrators can inject arbitrary HTML content into time tracking entries, potentially enabling phishing attacks or UI manipulation against other users viewing the affected entries.

Affected Products

• OpenProject versions prior to 16.6.7
• OpenProject versions prior to 17.0.3

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25764 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25764

Vulnerability Analysis

This HTML injection vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page) occurs due to insufficient output encoding in the time tracking module of OpenProject. When administrators create work packages with specially crafted names containing HTML elements, the application renders these tags directly in the browser without proper sanitization.

The attack requires administrator-level access to the OpenProject instance, which limits the attack surface but still presents a risk in multi-tenant or shared administrative environments. The impact is primarily on integrity, as injected HTML could be used to modify the visual appearance of pages or create convincing phishing elements within the trusted application context.

Root Cause

The root cause is improper neutralization of user-supplied input in the work package name field. When work package names are displayed within the time tracking interface, the application fails to apply appropriate HTML entity encoding or escaping, allowing raw HTML tags to be interpreted and rendered by the browser.

Attack Vector

The attack vector is network-based and requires authenticated access with administrator privileges. An attacker would need to:

1. Authenticate to the OpenProject instance with administrator credentials
2. Create a new work package with malicious HTML tags embedded in the name field
3. Add the crafted work package to the time tracking section
4. Wait for other users to view the time tracking entries containing the injected HTML

The vulnerability is particularly concerning in environments where multiple administrators share access or where administrator accounts could be compromised, as it could be used to escalate attacks against other users.

Detection Methods for CVE-2026-25764

Indicators of Compromise

• Unusual HTML tags or JavaScript-like patterns appearing in work package names within the database
• Time tracking entries containing unexpected formatting or visual elements
• User reports of unusual UI behavior or suspicious content in time tracking views
• Audit logs showing work package creation with abnormal character patterns in name fields

Detection Strategies

• Implement content security policies to detect and log attempts to render unexpected HTML content
• Monitor database queries for work package names containing common HTML tags such as <script>, <iframe>, <img>, or <a>
• Review audit logs for work package modifications by administrator accounts that include HTML special characters
• Deploy web application firewall rules to detect HTML injection patterns in form submissions

Monitoring Recommendations

• Enable comprehensive audit logging for all work package creation and modification activities
• Configure alerts for work package names containing angle brackets or HTML entity patterns
• Regularly review administrator activity logs for anomalous behavior
• Implement real-time monitoring of time tracking module access patterns

How to Mitigate CVE-2026-25764

Immediate Actions Required

• Upgrade OpenProject to version 16.6.7 or 17.0.3 or later immediately
• Review existing work packages for any signs of HTML injection in name fields
• Audit administrator account access and verify all accounts are authorized
• Implement additional input validation at the web application firewall level as a defense-in-depth measure

Patch Information

OpenProject has released patched versions that address this vulnerability. According to the GitHub Security Advisory GHSA-q523-c695-h3hp, the fix has been incorporated into OpenProject version 16.6.7 and OpenProject version 17.0.3. Organizations should upgrade to these patched versions or later to remediate the vulnerability.

Workarounds

• Restrict administrator privileges to only trusted personnel until patching can be completed
• Implement content security policy headers to mitigate the impact of any injected HTML
• Deploy web application firewall rules to filter HTML tags from work package name submissions
• Regularly audit work package names for suspicious content patterns as a compensating control