CVE-2026-22600: OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-10 · updated 2026-06-17
Weakness: CWE-200

Description

OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.

Affected products

opf openproject: before 16.6.4 — fixed in 16.6.4

How to fix

Upgrade to a fixed version: opf openproject 16.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-22600 or the next vulnerability affects your stack