CVE Intelligence
Analysis AI-assisted

CVE-2026-22600: OpenProject Arbitrary File Read via ImageMagick SVG Coder in PDF Export

CVE-2026-22600 affects OpenProject versions before 16.6.4. According to the GitHub advisory, a crafted SVG file uploaded as a work package attachment can lead to local file read when the work package is exported to PDF, through the ImageMagick text coder. The record reports a critical CVSS score of 9.1 but no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22600 is a local file read issue in the work package PDF export of OpenProject. The GitHub advisory describes a crafted SVG file, disguised as a PNG, that is processed by ImageMagick when the work package is exported. The record maps the weakness to CWE-200, Exposure of Sensitive Information.

Impact

  • The record states that an attacker can read arbitrary local files that the application user can access.
  • Examples given in the record include system files such as /etc/passwd and project configuration and private project data.
  • The CVSS vector in the record indicates network attack vector, low privileges required, no user interaction, changed scope, high confidentiality impact, and low integrity and availability impact.

Affected products and versions

  • The record lists OpenProject entries with versions before 16.6.4 (listed as less than 16.6.4).
  • Fixed version: 16.6.4, per the GitHub advisory and the release tag cited in the record.
  • Versions before 16.6.4 should be treated as affected; the record does not list intermediate versions.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC data in the record marks exploitation as none and automatable as no.
  • The EPSS probability in the record is 0.00304 with a percentile of 0.22055.

Remediation and mitigation

  • Upgrade OpenProject to version 16.6.4 or later.
  • The advisory states that users unable to upgrade may apply the patch manually.
  • Restrict who can upload attachments to work packages and other exportable containers, as the record notes that upload permission is required.
  • Review the image processing pipeline and limit the file types accepted for attachments that are later rendered or exported.

Detection guidance

  • Review attachment uploads for files whose content does not match their declared type, especially SVG content labeled as PNG.
  • Monitor PDF export activity and backend image processing logs for unexpected failures or access to files outside the application data directory.
  • Audit application user permissions, since the impact depends on the files accessible to the application user.

Limitations of the available information

  • The record does not state the exact ImageMagick version or configuration affected.
  • The record does not provide details on which specific project files can be read in a given deployment.
  • The record does not confirm whether any public exploit or active campaign exists.
  • The EPSS date in the record is later than the publication date and should be verified against the current feed.

Frequently asked questions

What is CVE-2026-22600?

It is a local file read vulnerability in the PDF export of OpenProject work packages, triggered through ImageMagick processing of a crafted SVG attachment. The record says it is fixed in version 16.6.4.

Is this CVE being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.