Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-28 | 3 | Disclosure3 |
| 2026-01-30 | 1 | Disclosure1 |
Warning: Critical Command Injection in #OpenProject. #CVE-2026-24685 CVSS: 9.4. This command injection allows attackers to overwrite files leading to data loss and causing Denial of Service. #Patch #Patch #Patch
Post summary
A critical command injection CVE‑2026‑24685 in OpenProject has been announced, with high severity and potential for file overwrites, data loss, and denial of service, and a patch is implied to be available.
CVE-2026-24685 Arbitrary File Write Vulnerability in OpenProject Repository Diff... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24685 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text announces CVE-2026-24685 as an arbitrary file‑write vulnerability in OpenProject, but provides no PoC, exploit, active exploitation, patch, or false‑positive information.
CVE-2026-24685 OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s … https://www.cve.org/CVERecord?id=CVE-2026-24685
Post summary
The text announces an arbitrary file write vulnerability in older OpenProject releases (CVE-2026-24685), without providing a PoC, exploit, or patch details.
🚨 CVE-2026-24685: OpenProject has Argument Injecti... Command injection in OpenProject's diff endpoint lets any repo browser write arbitrary files via crafted `rev` param—pe... https://zerodaysignal.com/vulnerability/CVE-2026-24685 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post reports a command injection flaw in OpenProject’s diff endpoint that allows writing arbitrary files via a crafted parameter. No patch, PoC, or active exploitation evidence is given.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openproject | openproject | - | - | - |