Executive Summary

CVE-2026-22601 is a command injection vulnerability in OpenProject versions 16.6.1 and below. A registered administrator can exploit this flaw by configuring the 'System path to sendmail' setting with malicious input. When the application sends a test email, it executes this input in a Linux shell without proper sanitization, allowing the attacker to run arbitrary commands on the underlying system with high privileges. [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact as it allows an attacker with administrator access to execute arbitrary commands on the server hosting OpenProject. This can lead to full system compromise, including unauthorized access to sensitive data, disruption of services, and potential further exploitation of the network. The CVSS score of 8.6 indicates a high impact on confidentiality, integrity, and availability. [2]

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenProject instance is version 16.6.1 or below and if the 'System path to sendmail' setting under Administration → Emails and Notifications → Mail Notification is configurable by an administrator. You can verify the OpenProject version by running a command like `dpkg -l | grep openproject` or checking the application UI. Additionally, inspect the sendmail path setting for suspicious command injection patterns. Since the vulnerability involves command injection via the sendmail path, monitoring logs for unusual command executions or email sending failures may help. There are no specific commands provided to detect exploitation, but verifying the version and configuration is key. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading OpenProject to version 16.6.2 or later, where the vulnerability is patched. If upgrading is not immediately possible, set the sendmail executable path using the environment variable OPENPROJECT_SENDMAIL__LOCATION, which makes the setting read-only and prevents modification through the web interface. Also, restrict administrator privileges carefully to trusted users only, as the vulnerability requires administrator access to exploit. [1, 2]

Useful 0 Not Useful 0