CVE-2026-25763 is a critical flaw (CVSS 9.9) in OpenProject's repository changes view. A user with browse repository permission can inject options into a git log command and write files on the server. Versions before 16.6.7 and 17.0.3 are affected, and those releases fix it.
What's affected
- Product: OpenProject, the open source project management software.
- Affected: versions before 16.6.7 on the 16.x line, and before 17.0.3 on the 17.x line.
- Fixed: 16.6.7 and 17.0.3.
- Precondition: the attacker needs the browse repository permission on a project that has a repository.
How to check if you're exposed
Check your version in the administration information page, or from your deployment:
docker ps --format '{{.Image}}' | grep -i openproject
Then list which projects have repositories enabled and who holds the browse repository permission on them.
What to do now
- Upgrade to 16.6.7 or 17.0.3, depending on your release line.
- Until then, disable the repository module on projects that do not need it, or remove the browse repository permission from roles that do not need it.
- Run the application as an unprivileged user with write access only to its own directories.
- Check for unexpected files in writable locations such as temporary directories and application paths.
- Rotate secrets reachable from the server if you find signs of tampering.
Why it matters
The record lists CWE-78, OS command injection. A value meant to be a revision name was passed to git without being separated from options, so git read part of it as a flag that changes where output goes.
The advisory explains that the written content is git log output, but commit content is controllable, which is enough to place scripts and reach code execution. The high score comes from the chain from a low permission to remote code. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
Start with a list of OpenProject projects that have a repository attached, since that is the feature in the advisory. If you do not use the repository module, disable it now and the exposure drops while you plan the upgrade.
The attacker needs the browse repository permission, so review roles. In many setups every project member holds it, which means the realistic attacker is any authenticated user, including guests added to a single project. Upgrade to 16.6.7 or 17.0.3 and check for unexpected files that the application user could have written.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which permission is needed?
The advisory states browse repository on the project.
What is the general lesson?
Pass an end of options marker or validate values before handing user input to command line tools.
Sources
Last reviewed: 19 October 2026.
