CVE-2026-25763— Command Injection on OpenProject repositories leads to Remote Code Execution

Command Injection on OpenProject repositories leads to Remote Code Execution

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in OpenProject’s repository changes endpoint (/projects/:project_id/repository/changes) when rendering the “latest changes” view via git log. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git log command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git log output, but by crafting custom commits the attacker can still upload valid shell scripts, ultimately leading to RCE. The RCE lets the attacker create a reverse shell to the target host and view confidential files outside of OpenProject, such as /etc/passwd. This issue has been patched in versions 16.6.7 and 17.0.3.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

OpenProject 操作系统命令注入漏洞

OpenProject是OpenProject开源的一个基于Web的项目管理软件。 OpenProject 16.6.7之前版本和17.0.3之前版本存在操作系统命令注入漏洞，该漏洞源于存储库更改端点存在任意文件写入漏洞，可能导致远程代码执行。

N/A

N/A