CVE-2026-52780: OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.3.3 - Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52780?
CVE-2026-52780 has a severity rating of 9.6, classified as critical.
What does CVE-2026-52780 affect?
CVE-2026-52780 affects OpenProject versions prior to 17.3.3 and 17.4.1.
How do I fix CVE-2026-52780?
To fix CVE-2026-52780, upgrade OpenProject to version 17.3.3 or 17.4.1.
What type of vulnerability is CVE-2026-52780?
CVE-2026-52780 is categorized as a Remote Code Execution (RCE) vulnerability caused by cache store poisoning.
What is the potential impact of CVE-2026-52780?
The potential impact of CVE-2026-52780 includes unauthorized remote code execution on affected systems.