CVE-2026-30234: OpenProject Path Traversal Vulnerability

CVE-2026-30234 Overview

OpenProject is an open-source, web-based project management software that contains a path traversal vulnerability in its BCF (BIM Collaboration Format) import functionality. Prior to version 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the <Snapshot> value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untrusted <Snapshot> value is used as file.path during attachment processing, allowing local filesystem content to be read outside the intended ZIP scope. This results in an Arbitrary File Read (AFR) within the read permissions of the OpenProject application user.

Critical Impact

Authenticated attackers with BCF import permissions can read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and private data accessible to the OpenProject application user.

Affected Products

• OpenProject versions prior to 17.2.0
• OpenProject installations with BCF import functionality enabled
• Systems where authenticated users have BCF import permissions

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-30234 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30234

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in how OpenProject processes BCF archive imports, specifically in the handling of the <Snapshot> element within the markup.bcf file.

The BCF format is an open standard for communication during building information modeling (BIM) projects. When a user imports a BCF archive, OpenProject parses the XML markup files and processes referenced attachments. The vulnerability arises because the application fails to properly validate and sanitize the <Snapshot> path value before using it during file operations.

An attacker can craft a malicious BCF archive containing path traversal sequences such as ../ or absolute paths like /etc/passwd in the <Snapshot> element. When this archive is imported, the application uses the attacker-controlled path directly, allowing file reads outside the intended archive scope.

Root Cause

The root cause is insufficient input validation on the <Snapshot> value extracted from the markup.bcf XML file. The application trusts this user-controlled value and uses it directly as file.path during attachment processing without proper path canonicalization or validation to ensure the path remains within the expected ZIP archive boundaries.

Attack Vector

The attack requires network access and authentication with BCF import permissions. The attacker must:

1. Create a malicious .bcf archive containing a markup.bcf file with a manipulated <Snapshot> value pointing to a target file on the server
2. Upload and import the crafted BCF archive through the OpenProject web interface
3. The application processes the archive and reads the specified file path, exposing its contents

The vulnerability exploits the path traversal technique where sequences like ../../../../etc/passwd navigate up the directory tree to access files outside the intended scope. Alternatively, absolute paths can be used directly.

The attack surface includes any file readable by the OpenProject application user, which may include configuration files, database credentials, private keys, and other sensitive data stored on the server.

Detection Methods for CVE-2026-30234

Indicators of Compromise

• Unusual BCF file imports containing path traversal sequences (../, ..\\) in archive contents
• Web application logs showing requests to BCF import endpoints with subsequent file access errors or unusual file read operations
• Server access logs indicating reads of sensitive system files by the OpenProject process

Detection Strategies

• Monitor BCF import operations for archives containing suspicious path patterns in XML markup files
• Implement file integrity monitoring on sensitive configuration files and credentials
• Review OpenProject application logs for unusual attachment processing behavior
• Deploy web application firewall rules to inspect uploaded archive contents for path traversal patterns

Monitoring Recommendations

• Enable verbose logging for BCF import functionality to capture detailed processing information
• Set up alerts for access attempts to sensitive system paths by the OpenProject application user
• Monitor for unusual network activity following BCF import operations that may indicate data exfiltration
• Regularly audit user permissions to ensure BCF import access is restricted to trusted users

How to Mitigate CVE-2026-30234

Immediate Actions Required

• Upgrade OpenProject to version 17.2.0 or later immediately
• Review and restrict BCF import permissions to only essential trusted users
• Audit recent BCF imports for potentially malicious archives
• Review application logs for signs of exploitation attempts

Patch Information

This vulnerability is fixed in OpenProject version 17.2.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information and release notes, refer to the GitHub Security Advisory.

Workarounds

• Temporarily disable BCF import functionality if not critical to operations until the patch can be applied
• Restrict BCF import permissions to administrators only until the upgrade is complete
• Implement network segmentation to limit the impact of potential file read attacks
• Use file system permissions to restrict the OpenProject application user's read access to only necessary files

# Configuration example - Restrict BCF import permissions
# Review and revoke BCF import permissions for non-essential users
# In OpenProject admin panel: Administration > Users & Permissions > Roles
# Remove "Import BCF" permission from roles that don't require it

# Alternatively, apply file system restrictions to limit readable files
# Ensure OpenProject runs with minimal required permissions
chmod 600 /etc/openproject/database.yml
chown openproject:openproject /etc/openproject/database.yml