CVE-2026-22600

OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.

• CWE-200

• https://github.com/opf/openproject/releases/tag/v16.6.4Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-m8f2-cwpq-vvhhPatch

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22595Ghost is a Node.js content management system. In versions 5.…8.1
• CVE-2026-22596Ghost is a Node.js content management system. In versions 5.…7.2
• CVE-2026-22597Ghost is a Node.js content management system. In versions 5.…2.7
• CVE-2026-22598ManageIQ is an open-source management platform. A flaw was f…7.1
• CVE-2026-22599Strapi is an open source headless content management system.…7.2
• CVE-2026-2260A vulnerability was found in D-Link DCS-931L up to 1.13.0. T…7.3
• CVE-2026-22601OpenProject is an open-source, web-based project management …7.2
• CVE-2026-22602OpenProject is an open-source, web-based project management …3.5
• CVE-2026-22603OpenProject is an open-source, web-based project management …6.5
• CVE-2026-22604OpenProject is an open-source, web-based project management …5.3
• CVE-2026-22605OpenProject is an open-source, web-based project management …4.3
• CVE-2026-22606Fickling is a Python pickling decompiler and static analyzer…7.8