{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E445CBC-3EAC-4310-BF92-C9DC0CC0AF09",
              "versionEndExcluding": "16.6.5",
              "versionStartExcluding": "16.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject\u2019s roadmap view renders the \u201cRelated work packages\u201d list for each version. When a version contains work packages from a different project (e.g., a subproject), the helper link_to_work_package prepends package.project.to_s to the link and returns the entire string with .html_safe. Because project names are user-controlled and no escaping happens before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. The underlying issue is mitigated in versions 16.6.5 and 17.0.0 by setting a `X-Content-Type-Options: nosniff` header, which was in place until a refactoring move to Rails standard content-security policy, which did not properly apply this header in the new configuration since OpenProject 16.3.0. Those who cannot upgrade their installations should ensure that they add a X-Content-Type-Options: nosniff header in their proxying web application server."
    },
    {
      "lang": "es",
      "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Las versiones 16.3.0 a la 16.6.4 est\u00e1n afectadas por una vulnerabilidad de cross-site scripting almacenado en la vista de Hoja de Ruta. La vista de hoja de ruta de OpenProject renderiza la lista de \u0027Paquetes de trabajo relacionados\u0027 para cada versi\u00f3n. Cuando una versi\u00f3n contiene paquetes de trabajo de un proyecto diferente (por ejemplo, un subproyecto), el ayudante link_to_work_package antepone package.project.to_s al enlace y devuelve la cadena completa con .html_safe. Debido a que los nombres de los proyectos son controlados por el usuario y no se produce ning\u00fan escape antes de llamar a html_safe, cualquier HTML colocado en el nombre de un subproyecto se inyecta textualmente en la p\u00e1gina. El problema subyacente se mitiga en las versiones 16.6.5 y 17.0.0 al establecer un encabezado \u0027X-Content-Type-Options: nosniff\u0027, que estuvo en su lugar hasta una refactorizaci\u00f3n a la pol\u00edtica de seguridad de contenido est\u00e1ndar de Rails, que no aplic\u00f3 correctamente este encabezado en la nueva configuraci\u00f3n desde OpenProject 16.3.0. Aquellos que no puedan actualizar sus instalaciones deben asegurarse de a\u00f1adir un encabezado \u0027X-Content-Type-Options: nosniff\u0027 en su servidor de aplicaciones web de proxy."
    }
  ],
  "id": "CVE-2026-23625",
  "lastModified": "2026-02-02T20:49:09.927",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-19T18:16:05.437",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/opf/openproject/releases/tag/v16.6.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/opf/openproject/releases/tag/v17.0.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory",
        "Mitigation"
      ],
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-cvpq-cc56-gwxx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}