LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23625: OpenProject has stored XSS regression using attachments and script-src self

OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work packages from a different project (e.g., a subproject), the helper link_to_work_package prepends package.project.to_s to the link and returns the entire string with .html_safe. Because project names are user-controlled and no escaping happens before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. The underlying issue is mitigated in versions 16.6.5 and 17.0.0 by setting a `X-Content-Type-Options: nosniff` header, which was in place until a refactoring move to Rails standard content-security policy, which did not properly apply this header in the new configuration since OpenProject 16.3.0. Those who cannot upgrade their installations should ensure that they add a X-Content-Type-Options: nosniff header in their proxying web application server.

HighCVSS 8.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-23625 is a stored cross-site scripting issue in OpenProject’s Roadmap view. A user with project-naming ability can cause malicious HTML to be saved and later rendered to another user viewing affected roadmap content. The business risk is account/session compromise or unauthorized actions in OpenProject if a privileged user views the page.

Executive priority

Treat as high priority for internet-facing or broadly used OpenProject systems. Patch promptly, especially where many users can create or rename projects. There is no cited evidence of active exploitation, but the impact can be significant if an administrator or privileged user is targeted.

Technical view

OpenProject 16.3.0 through 16.6.4 are affected. In the Roadmap view, related work package links can include a user-controlled project name from another project. That name is marked html_safe without escaping, allowing stored HTML injection. The advisory attributes mitigation in 16.6.5 and 17.0.0 to restoring X-Content-Type-Options: nosniff behavior.

Likely exposure

Exposure is limited to OpenProject installations running versions 16.3.0 through before 16.6.5. The scenario requires an authenticated user able to influence project names and a victim user to view the affected Roadmap content.

Exploitation context

The CVSS vector is network-accessible, low complexity, requires low privileges, and requires user interaction. The source bundle does not indicate known active exploitation, and CISA KEV status is false.

Researcher notes

This is CWE-79 stored XSS caused by unsafe rendering of user-controlled project names in Roadmap related work package output. Avoid assuming exploit availability beyond the advisory details. Validate fixed state by version and header behavior, not by attempting weaponized XSS.

Mitigation direction

  • Upgrade OpenProject to 16.6.5 or 17.0.0, per vendor release references.
  • If unable to upgrade, add X-Content-Type-Options: nosniff at the proxying web application server.
  • Review the GitHub advisory and release notes for any deployment-specific guidance.

Validation and detection

  • Inventory OpenProject instances and confirm installed versions.
  • Prioritize any instance running 16.3.0 through 16.6.4.
  • Confirm the nosniff header is present where upgrades are delayed.
  • Review project and subproject naming permissions for untrusted users.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-23625 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.7CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N2.35.8Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.7High
CVSS 3.1 vector shape for CVE-2026-23625Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
opfopenproject>= 16.3.0, < 16.6.5Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs