Critical Severity Vulnerability
This vulnerability has been rated as Critical severity. Immediate action is recommended.
CVE-2026-22600
CriticalVulnerability Description
OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Known Affected Software
256 configuration(s) from 1 vendor(s)
cpe:2.3:a:openproject:openproject:16.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.11:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.1.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.9:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.1.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.1.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.20:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.3.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.14:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.13:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.17:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.11:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.19:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.2.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.6.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.1.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.5.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.14:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.9:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.3.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.12:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.2.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.5.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.16:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.18:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.12:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.16:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.10:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.17:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.5.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.6.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.3.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.15:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.6.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.2.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.4.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.13:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.10:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.15:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.9:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.0.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:11.3.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.3.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:16.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.4.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.12:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.6:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.6.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:15.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:14.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:13.4.2:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:12.1.5:*:*:*:*:*:*:*
cpe:2.3:a:openproject:openproject:7.0.0:*:*:*:*:*:*:*
Severity Details
Key Information
- Published Date
- January 10, 2026
