CVE-2026-23625
Unknown Unknown - Not Provided
Stored XSS in OpenProject Roadmap View via Subproject Names

Publication date: 2026-01-19

Last updated on: 2026-02-02

Assigner: GitHub, Inc.

Description
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work packages from a different project (e.g., a subproject), the helper link_to_work_package prepends package.project.to_s to the link and returns the entire string with .html_safe. Because project names are user-controlled and no escaping happens before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. The underlying issue is mitigated in versions 16.6.5 and 17.0.0 by setting a `X-Content-Type-Options: nosniff` header, which was in place until a refactoring move to Rails standard content-security policy, which did not properly apply this header in the new configuration since OpenProject 16.3.0. Those who cannot upgrade their installations should ensure that they add a X-Content-Type-Options: nosniff header in their proxying web application server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-19
Last Modified
2026-02-02
Generated
2026-06-16
AI Q&A
2026-01-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23625
EUVD
EUVD-2026-3309
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
opf openproject From 16.3.0 (inc) to 16.6.4 (inc)
opf openproject 16.6.5
opf openproject 17.0.0
openproject openproject From 16.3.0 (exc) to 16.6.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-23625 is a stored Cross-Site Scripting (XSS) vulnerability in OpenProject versions 16.3.0 through 16.6.4, specifically in the Roadmap view. The vulnerability occurs because the 'Related work packages' list includes work packages from different projects or subprojects, and the helper function 'link_to_work_package' prepends the project name to the link and marks the entire string as html_safe without escaping user-controlled project names. This allows an attacker to inject arbitrary HTML or script code via a subproject name, which is then rendered directly on the page, leading to stored XSS. The issue was introduced after a refactoring that removed the 'X-Content-Type-Options: nosniff' header, which was restored in later patched versions. [1]

Impact Analysis

This vulnerability can allow an attacker to inject malicious HTML or JavaScript code into the OpenProject Roadmap view, which is then stored and displayed to users. This can lead to high confidentiality and integrity impacts, such as theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of users. The CVSS v3.1 base score is 8.7, indicating high severity, with low attack complexity and low privileges required but requiring user interaction. [1]

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade OpenProject to version 16.6.5 or later, where the issue is fixed by restoring the X-Content-Type-Options: nosniff header. If upgrading is not possible, ensure that your proxy or web application server adds the X-Content-Type-Options: nosniff header to mitigate the vulnerability. [1, 2]

Compliance Impact

The provided resources do not explicitly discuss how this stored cross-site scripting (XSS) vulnerability in OpenProject affects compliance with common standards and regulations such as GDPR or HIPAA. Therefore, no direct information is available on the impact of this vulnerability on regulatory compliance.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart