SQL Injection in OpenProject Timestamps

Executive Summary

CVE-2026-52785 is a critical SQL injection vulnerability in the OpenProject software, specifically affecting versions prior to 17.3.3. The issue exists in the timestamps functionality, which allows callers to request historic work-package attributes. This flaw enables an attacker to inject malicious SQL code through the timestamps parameter.

Useful 0 Not Useful 0

Detection Guidance

The CVE-2026-52785 vulnerability is a critical SQL injection in the timestamps functionality of OpenProject versions prior to 17.3.3 and 17.4.1. Detection typically involves identifying if your OpenProject instance is running a vulnerable version and monitoring for suspicious requests targeting the timestamps parameter.

To detect this vulnerability on your system, first verify the OpenProject version installed. If it is older than 17.3.3 or 17.4.1, it is vulnerable.

• Check OpenProject version via command line or application interface.
• Monitor web server logs for unusual requests containing the 'timestamps' parameter, which may indicate exploitation attempts.

Example commands to check the OpenProject version or detect suspicious activity might include:

• Using curl to check the version or response headers: curl -I http://your-openproject-instance
• Searching logs for 'timestamps' parameter usage: grep 'timestamps' /var/log/apache2/access.log
• Using network monitoring tools or IDS to detect SQL injection patterns targeting the timestamps parameter.

Ultimately, the best mitigation is to upgrade OpenProject to version 17.3.3 or 17.4.1 or later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data and modification of data integrity. The CVSS score of 9.9 indicates a critical severity with high impact on confidentiality and integrity, and a lower but present impact on availability. An attacker can exploit this remotely with low privileges and no user interaction, potentially compromising the system's data and operations.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-52785 vulnerability is a critical SQL injection flaw that impacts the confidentiality and integrity of data within OpenProject software. Such a vulnerability could potentially lead to unauthorized access or manipulation of sensitive project data.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that compromise data confidentiality and integrity generally pose risks to compliance with these regulations, which require protection of personal and sensitive information.

Organizations using affected versions of OpenProject prior to 17.3.3 and 17.4.1 should apply patches promptly to mitigate risks that could lead to non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-52785 vulnerability, you should upgrade OpenProject to version 17.3.3 or 17.4.1, where the SQL injection issue in the timestamps functionality has been fixed.

Useful 0 Not Useful 0