PT-2026-29864

CVE-2026-34717

Published

2026-03-31

Updated

2026-04-03

Description by

CVSS 3.1

9.9

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.3

Description OpenProject, a web-based project management software, has an issue where user input is directly embedded into SQL WHERE clauses without proper parameterization. This occurs due to the =n operator in modules/reporting/lib/report/operator.rb:177. This could allow for SQL injection. The issue affects authenticated users and could potentially grant them database access.

Recommendations Update to version 17.2.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ochk0

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers