CVE-2026-30235: Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation of OpenProject’s Markdown rendering, specifically in the hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM clobbering. DOM clobbering can crash or blank the entire page by overwriting native DOM functions with HTML elements, causing critical JavaScript calls to throw runtime errors during application initialization and halt further execution. This vulnerability is fixed in 17.2.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30235?
CVE-2026-30235 has a medium severity level due to the potential for exploiting business logic errors in hyperlink handling.
How do I fix CVE-2026-30235?
To fix CVE-2026-30235, upgrade OpenProject to version 17.2.0 or later.
What type of vulnerability is CVE-2026-30235?
CVE-2026-30235 is classified as a business logic error associated with improper markdown rendering.
Which versions of OpenProject are affected by CVE-2026-30235?
OpenProject versions prior to 17.2.0 are affected by CVE-2026-30235.
Can CVE-2026-30235 lead to other security issues?
Yes, CVE-2026-30235 can potentially allow unauthorized actions through manipulated hyperlinks.