CVE-2026-52785 Overview
CVE-2026-52785 is a SQL injection vulnerability in OpenProject, an open-source, web-based project management platform. The flaw resides in the timestamps functionality used by the baseline comparison feature, which allows callers to request historic work-package attributes through the timestamps parameter. Attackers with low-privileged accounts can inject SQL statements through this parameter and reach the underlying database. The issue is tracked under [CWE-89] and is fixed in OpenProject versions 17.3.3 and 17.4.1.
Critical Impact
An authenticated attacker can exploit the timestamps parameter over the network to read, modify, or exfiltrate database contents, resulting in a scope change that affects other components beyond OpenProject itself.
Affected Products
- OpenProject versions prior to 17.3.3
- OpenProject 17.4.x versions prior to 17.4.1
- OpenProject baseline comparison / work-package history feature
Discovery Timeline
- 2026-06-26 - CVE-2026-52785 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-52785
Vulnerability Analysis
OpenProject supports baseline comparisons that let users view how a work package looked at a prior point in time. The client supplies a timestamps parameter that the backend uses to construct database queries against historic work-package attributes. Prior to the patched releases, this parameter was not properly sanitized or parameterized before being incorporated into the resulting SQL statement.
The vulnerability is exploitable over the network by an attacker holding a low-privileged OpenProject account. Successful exploitation exposes confidential project data, allows manipulation of work-package history, and can degrade application availability. The scope changes because the compromised database may host tenants or data beyond the OpenProject application boundary.
Root Cause
The root cause is improper neutralization of user-supplied input used in SQL statements [CWE-89]. The timestamps parameter accepted values that were interpolated into query fragments building the historic attribute lookup, rather than being bound as parameters or validated against a strict allow-list of timestamp formats.
Attack Vector
An authenticated attacker sends a crafted request to a work-package endpoint that supports baseline comparison, injecting SQL syntax through the timestamps query parameter. The server processes the tainted value while building a database query, executing attacker-controlled SQL under the OpenProject database role. No user interaction is required beyond the attacker's own session. Refer to the OpenProject GitHub Security Advisory GHSA-98vw-2r87-fx2r for additional technical detail.
Detection Methods for CVE-2026-52785
Indicators of Compromise
- Requests to OpenProject work-package endpoints containing SQL metacharacters such as ', --, ;, UNION, or SLEEP( inside the timestamps parameter.
- Unusual timestamps values that deviate from the expected ISO 8601 or PT duration formats used by the baseline comparison feature.
- Database errors, long-running queries, or elevated CPU on the OpenProject database correlated with work-package history requests.
Detection Strategies
- Inspect web server and reverse-proxy logs for timestamps= values containing SQL keywords or encoded payloads such as %27, %20UNION%20, or time-based probes.
- Enable database query logging on the OpenProject database and alert on syntax errors or queries returning abnormally large row counts from the work-package tables.
- Correlate authentication logs with anomalous work-package history activity from a single account, especially newly created or low-privilege users.
Monitoring Recommendations
- Deploy a web application firewall rule that validates the timestamps parameter against a strict timestamp grammar and blocks non-conforming requests.
- Monitor for spikes in 500-level responses from OpenProject endpoints handling baseline comparisons.
- Track outbound data volume from the OpenProject database host to identify potential exfiltration following a successful injection.
How to Mitigate CVE-2026-52785
Immediate Actions Required
- Upgrade OpenProject to version 17.3.3 or 17.4.1 without delay, choosing the release that matches the current deployment branch.
- Audit OpenProject accounts and disable or reset credentials for users that no longer require access, reducing the pool of accounts that can reach the vulnerable endpoint.
- Review database and application logs for evidence of exploitation attempts targeting the timestamps parameter dating back to the deployment of a vulnerable release.
Patch Information
The OpenProject maintainers addressed CVE-2026-52785 in versions 17.3.3 and 17.4.1. Patch details and downstream references are published in the OpenProject GitHub Security Advisory GHSA-98vw-2r87-fx2r. Apply the upgrade through the standard OpenProject packaged installation, Docker image, or Helm chart update path used in the environment.
Workarounds
- If immediate patching is not possible, restrict network access to the OpenProject instance to trusted users and networks via VPN or IP allow-listing.
- Place a web application firewall in front of OpenProject with a rule that rejects any timestamps parameter value that does not match a strict ISO 8601 timestamp or supported duration format.
- Reduce the OpenProject database user's privileges to the minimum required, preventing arbitrary reads from unrelated schemas until the upgrade is applied.
# Configuration example: WAF rule (ModSecurity) to enforce timestamps grammar
SecRule ARGS:timestamps "!@rx ^(PT-?\d+[SMHD]|\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(Z|[+-]\d{2}:\d{2})?)(,(PT-?\d+[SMHD]|\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(Z|[+-]\d{2}:\d{2})?))*$" \
"id:1052785,phase:2,deny,status:400,log,msg:'CVE-2026-52785 timestamps parameter rejected'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
