CVE-2026-32698

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.

• CWE-89

• https://github.com/opf/openproject/security/advisories/GHSA-jqhf-rf9x-9rhxVendor Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32692An authorization bypass vulnerability in the Vault secrets b…6.5
• CVE-2026-32693In Juju from version 3.0.0 through 3.6.18, the authorization…8.8
• CVE-2026-32694In Juju from version 3.0.0 through 3.6.18, when a secret own…6.6
• CVE-2026-32695Traefik is an HTTP reverse proxy and load balancer. Prior to…7.7
• CVE-2026-32696NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-32697SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-32699FacturaScripts is an open source accounting and invoicing so…5.3
• CVE-2026-3270A vulnerability has been found in psi-probe PSI Probe up to …8.8
• CVE-2026-32700Devise is an authentication solution for Rails based on Ward…5.3
• CVE-2026-32701Qwik is a performance-focused JavaScript framework. Versions…7.5
• CVE-2026-32702Cleanuparr is a tool for automating the cleanup of unwanted …5.3
• CVE-2026-32703OpenProject is an open-source, web-based project management …5.4