CVE-2026-22600 is a critical local file read flaw (CVSS 9.1) in OpenProject before version 16.6.4. A crafted SVG disguised as a PNG, attached to a work package, makes the ImageMagick text coder read files when the PDF is exported. The fix is OpenProject 16.6.4, so upgrade.
What's affected
OpenProject before 16.6.4. The fixed version is 16.6.4.
The attacker needs permission to upload attachments to something that can be exported to PDF, such as a work package. The advisory says the files readable are those the application user can access, including project configuration files and private project data.
If you cannot upgrade, the advisory offers a patch file named 70329-narrow-mime-type.patch.
How to check if you're exposed
Find your OpenProject version on the administration information page, or from your container image tag.
docker ps --format "table Names\tImage" | grep -i openproject
Anything before 16.6.4 is affected. Then check who can add attachments to work packages and who can export to PDF. The advisory lists removing PDF export permission as a workaround.
What to do now
- Upgrade OpenProject to 16.6.4 or later.
- If you cannot upgrade yet, apply the manual patch named in the advisory.
- As another stopgap, remove the PDF export permission from users until you have upgraded.
- Review recent attachments on work packages for files whose type does not match their content.
- Rotate any secrets stored in files that the OpenProject user could read, such as configuration and keys.
- Keep ImageMagick policy restrictive on any host that processes uploads.
Why it matters
The weakness is mapped to CWE-200, exposure of sensitive information. The cause in the advisory is a chain: an upload that claims to be an image is not checked tightly enough, the backend resizes it with ImageMagick for the PDF, and the text coder in ImageMagick treats the content in a way that reads a local file into the output.
Two things make this worth taking seriously. The scope in the vector is changed, because the file read reaches beyond the application itself. And the readable files include configuration that may hold database passwords and keys. The fix narrows the accepted MIME type, according to the name of the manual patch.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The advisory credits the researchers who reported it through the project bounty program.
Try it yourself
Fixing one flaw is easy. Keeping track of all of them is the work. This demo shows a vulnerability management view.
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need an account?
Yes. They need permission to upload attachments to a container that can be exported to PDF, such as a work package.
Can I avoid upgrading?
The advisory lists a manual patch and removing PDF export permission as options. Upgrading to 16.6.4 is the clean fix.
What should I rotate?
Any secret stored in files the OpenProject user can read, if you suspect misuse. The record notes configuration files are in scope.
Sources
Last reviewed: 19 October 2026.
