PT-2026-2221 · Openproject · Openproject
CVE-2026-22601
·
Publicado
2026-01-10
·
Atualizado
2026-01-15
CVSS v4.0
8.6
Alta
| Vetor | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenProject versions 16.6.1 and below
Description
OpenProject is a web-based project management software. A registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. The issue allows for command execution through the email functionality.
Recommendations
Update to OpenProject version 16.6.2 or later.
Exploit
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openproject