OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

Description

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.

Scores

EPSS (exploitation in 30 days)

0.37% · top 69% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (opens in a new tab)All about CWE-77 and its CVEs

Affected products

• opf · openproject

  • affected < 16.6.6
  • affected >= 17.0.0, < 17.0.2

References (1)

• https://github.com/opf/openproject/security/advisories/GHSA-74p5-9pr3-r6pw (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-24685](https://trackcve.app/badge/CVE-2026-24685.svg)](https://trackcve.app/cve/CVE-2026-24685)

Record last updated 28 Jan 2026, 17:54 UTC.