CVE-2026-32698
Published: 18 March 2026
Summary
CVE-2026-32698 is a critical-severity SQL Injection (CWE-89) vulnerability in Openproject Openproject. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of custom field names and project identifiers before use in SQL queries and filesystem paths, directly preventing SQL injection and path traversal.
Mandates timely remediation of the SQL injection and unsanitized path flaws through patching to versions that fix the vulnerabilities.
Enforces restrictions on special characters in inputs like custom field names and project identifiers to block injection payloads and path traversal attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing OpenProject web app directly enables T1190 exploitation; admin-to-RCE chain via malicious custom field and path manipulation constitutes T1068 priv esc; resulting arbitrary Ruby code execution on restart facilitates T1059.004 Unix Shell access.
NVD Description
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom…
more
field's name was injected into the SQL query without proper sanitation. This allowed an attacker to execute arbitrary SQL commands during the generation of a Cost Report. As custom fields can only be generated by users with full administrator privileges, the attack surface is somewhat reduced. Together with another bug in the Repositories_module, that used the project identifier without sanitation to generate the checkout path for a git repository in the filesystem, this allowed an attacker to checkout a git repository to an arbitrarily chosen path on the server. If the checkout is done within certain paths within the OpenProject application, upon the next restart of the application, this allows the attacker to inject ruby code into the application. As the project identifier cannot be manually edited to any string containing special characters like dots or slashes, this needs to be changed via the SQL injection described above. Versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1 fix the issue.
Deeper analysisAI
OpenProject, an open-source web-based project management software, is affected by CVE-2026-32698, an SQL injection vulnerability in versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1. The flaw occurs when a custom field's name is used in a Cost Report, as the name is injected into the SQL query without proper sanitization, enabling arbitrary SQL command execution during report generation. Custom fields require full administrator privileges to create, which limits the initial attack surface.
An attacker with administrator privileges can exploit this by crafting a malicious custom field name to inject SQL payloads during Cost Report generation. This allows manipulation of the project identifier, which lacks sanitization in the Repositories module. By altering the identifier via SQL injection to include special characters like dots or slashes—normally not editable manually—the attacker can trigger a git repository checkout to an arbitrary filesystem path. If this path falls within specific OpenProject application directories, the next application restart executes injected Ruby code, achieving remote code execution.
The GitHub Security Advisory (GHSA-jqhf-rf9x-9rhx) details the issue and confirms that upgrading to OpenProject versions 16.6.9, 17.0.6, 17.1.3, or 17.2.1 resolves the SQL injection and related repository path traversal vulnerabilities through proper input sanitization.
Details
- CWE(s)