CVE-2026-22600 — AI Deep Analysis Summary

🚨 **Essence**: OpenProject has an **Information Disclosure** flaw. 📄 The PDF export feature allows **Local File Read** via malicious SVG uploads.…

🛡️ **Root Cause**: **CWE-200** (Information Exposure). 🐛 **Flaw**: The backend image processing engine fails to sanitize inputs.…

👥 **Affected**: Users of **OpenProject**. 📅 **Versions**: All versions **prior to 16.6.4**. 📦 **Component**: The Web-based project management tool, specifically the **Work Package PDF Export** functionality.

💻 **Hackers' Power**: Can read **Arbitrary Local Files** on the server. 🔓 **Privileges**: Requires **Low Privilege** (PR:L) access.…

🔓 **Threshold**: **Low**. 🌐 **Network**: Remote (AV:N). 🛡️ **Auth**: Requires **Low Privileges** (PR:L) - likely a standard user account. 🚫 **UI**: No User Interaction needed (UI:N).…

🚫 **Public Exp?**: **No**. The `pocs` field is empty. 📝 **Status**: Only vendor advisories and release notes are linked. No public Proof-of-Concept (PoC) or wild exploitation scripts are currently available in the data.

🔍 **Self-Check**: Look for the **PDF Export** feature in Work Packages. 📤 **Test**: Try uploading a crafted SVG file (if safe in test env) and check if the export triggers file reads.…

✅ **Fixed?**: **Yes**. 📦 **Patch**: Version **16.6.4** resolves this issue. 🔗 **Reference**: See the GitHub Security Advisory (GHSA-m8f2-cwpq-vvhh) and the v16.6.4 release notes for official confirmation.

🚧 **No Patch?**: **Workaround**: Disable or restrict the **PDF Export** feature for work packages. 🛑 **Mitigation**: Limit access to the export function to trusted admins only.…

🔥 **Urgency**: **High Priority**. 🚨 **Why**: Remote exploitability + Low Auth requirement + High Data Loss risk. 🏃 **Action**: Upgrade to **v16.6.4** immediately if you are running an older version. Do not ignore this!