CVE-2026-22601: OpenProject is Vulnerable to Code Execution in E-Mail function
OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22601?
CVE-2026-22601 is considered a high severity vulnerability due to the possibility of arbitrary command execution by registered administrators.
How do I fix CVE-2026-22601?
To fix CVE-2026-22601, upgrade OpenProject to version 16.6.2 or later.
What versions of OpenProject are affected by CVE-2026-22601?
OpenProject versions 16.6.1 and below are affected by CVE-2026-22601.
What kind of attack can be performed using CVE-2026-22601?
An attacker can execute arbitrary commands on the server by improperly configuring the sendmail binary path.
Is there a patch available for CVE-2026-22601?
Yes, a patch is available in OpenProject version 16.6.2, which resolves the vulnerability.