CVE-2025-24892: OpenProject stored HTML injection vulnerability
OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24892?
CVE-2025-24892 has a medium severity rating due to improper input sanitization that could lead to cross-site scripting (XSS) issues.
How do I fix CVE-2025-24892?
To fix CVE-2025-24892, upgrade OpenProject to version 15.2.1 or later where the vulnerability has been addressed.
Which versions of OpenProject are affected by CVE-2025-24892?
CVE-2025-24892 affects OpenProject versions prior to 15.2.1.
What kind of attack does CVE-2025-24892 enable?
CVE-2025-24892 enables attackers to execute arbitrary HTML or JavaScript code in the context of a user's session through XSS.
Is user input the only vulnerability source in CVE-2025-24892?
Yes, the vulnerability primarily arises from the improper handling of user-generated input before displaying it in the Group Management section.