CVE-2026-52781: OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants <macro> elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachment and passes it to renderStreamMessage(). This executes arbitrary Turbo Stream actions — including redirectto — in every victim's authenticated browser session, redirecting them to an attacker-controlled server. This vulnerability is fixed in 17.3.3 and 17.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.3.3 - Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52781?
The severity of CVE-2026-52781 is medium with a score of 6.4.
How do I fix CVE-2026-52781?
To resolve CVE-2026-52781, upgrade OpenProject to versions 17.3.3 or 17.4.1 or later.
What type of vulnerability is CVE-2026-52781?
CVE-2026-52781 is a stored Cross-Site Scripting (XSS) vulnerability.
What is the attack vector for CVE-2026-52781?
The attack vector for CVE-2026-52781 is through the POST parameter "description" in the work packages API.
What can an attacker achieve using CVE-2026-52781?
An attacker can potentially execute arbitrary JavaScript code in the context of an affected user's session.