Medium severity · published Feb 10, 2025
CVE-2025-24892
OpenProject stored HTML injection vulnerability
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openproject · opf
< 15.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24892
Patch
https://github.com/opf/openproject/pull/17783
Patch
https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j
Patch
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
Release Notes
https://www.openproject.org/docs/release-notes/12-5-1
More from openproject
9.9
CVE-2026-46386
OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
9.9
CVE-2026-52782
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
9.9
CVE-2026-52785
OpenProject: SQL injection in timestamps functionality
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.6
CVE-2026-52780
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)