CVE-2026-67527

Deferred Deferred - Pending Action

Path Traversal in OpenProject via FileLink Manipulation

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67527

EUVD

EUVD-2026-51280

Affected Vendors & Products

Vendor	Product	Version / Range
openproject	openproject	to 17.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

OpenProject before version 17.6.0 had an API endpoint PATCH /api/v3/work_packages/{id} that accepted _links.fileLinks. Authenticated users with edit_work_packages but without manage_file_links permissions could manipulate file links. They could resolve, detach, hard-delete, or re-parent FileLinks to attacker-controlled work packages, exposing metadata like origin filename, ID, and MIME type.

Detection Guidance

To detect this vulnerability, check OpenProject versions prior to 17.6.0. Verify if users with edit_work_packages permissions can access or modify file links via API endpoints like PATCH /api/v3/work_packages/{id}. Monitor logs for unauthorized file link operations or metadata exposure.

Impact Analysis

An attacker with edit_work_packages permissions could access sensitive file metadata, delete or detach files, or re-parent files from other projects. This could lead to data leakage, unauthorized file access, or disruption of project files.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's integrity and confidentiality requirements. Organizations using affected versions may face compliance risks and potential regulatory penalties.

Mitigation Strategies

Upgrade OpenProject to version 17.6.0 or later to address the vulnerability. Ensure only users with proper permissions can edit work packages and manage file links.

Hi! I’m here to help you understand CVE-2026-67527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70