CVE-2026-34717: OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34717?
CVE-2026-34717 has been classified as a critical vulnerability due to its potential for SQL injection.
How do I fix CVE-2026-34717?
To mitigate CVE-2026-34717, upgrade your OpenProject installation to version 17.2.3 or later.
What type of vulnerability is CVE-2026-34717?
CVE-2026-34717 is an SQL injection vulnerability affecting OpenProject.
Which versions of OpenProject are affected by CVE-2026-34717?
Versions of OpenProject prior to 17.2.3 are vulnerable to CVE-2026-34717.
What impact does CVE-2026-34717 have on OpenProject users?
CVE-2026-34717 allows attackers to execute arbitrary SQL queries, potentially compromising the database.