What’s Vulnerable › Vulnerabilities

CVE-2025-24892: OpenProject stored HTML injection vulnerability

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-10 · updated 2026-06-17
• Weakness: CWE-79

Description

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.

Affected products

• opf openproject: before 15.2.1 — fixed in 15.2.1

How to fix

Upgrade to a fixed version: opf openproject 15.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/opf/openproject/pull/17783
• https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j
• https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
• https://www.openproject.org/docs/release-notes/12-5-1

Get alerted when CVE-2025-24892 or the next vulnerability affects your stack