PT-2026-2221 · Openproject · Openproject
CVE-2026-22601
·
Published
2026-01-10
·
Updated
2026-01-15
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenProject versions 16.6.1 and below
Description
OpenProject is a web-based project management software. A registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. The issue allows for command execution through the email functionality.
Recommendations
Update to OpenProject version 16.6.2 or later.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openproject