CVE Intelligence
Analysis AI-assisted

CVE-2026-52785: OpenProject SQL Injection in Timestamps Parameter

CVE-2026-52785 is a critical SQL injection flaw in the timestamps functionality of OpenProject, an open-source web-based project management application. The description states that versions prior to 17.3.3 and 17.4.1 are affected and that the issue is fixed in 17.3.3 and 17.4.1. The sources consulted do not confirm any exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

OpenProject is open-source, web-based project management software. According to the GitHub Security Advisory, a SQL injection flaw exists in the timestamps functionality used by the baseline comparison feature, which lets callers request historic work-package attributes through the timestamps parameter. The CNA classifies the weakness as CWE-89 (SQL Injection).

Impact

  • The CVSS v3.1 vector reported by the CNA indicates network reachability, low attack complexity, low privileges required, no user interaction, changed scope, high confidentiality and integrity impact, and low availability impact.
  • The CNA reports a base score of 9.9 with severity critical.
  • The record does not describe which specific data could be read or modified.

Affected products and versions

  • The description states that the product is affected prior to 17.3.3 and 17.4.1.
  • The structured affected and fixed-version fields in the record are empty, so the exact version ranges should be confirmed in the advisory.

Exploitation status

  • The CISA KEV catalog entry for this CVE is not listed in the record.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade OpenProject to 17.3.3 or 17.4.1, depending on the release line in use, as stated in the description.
  • Where an upgrade cannot happen immediately, restrict access to the application to trusted users and networks, and limit accounts that can use baseline comparison features.
  • Review the official advisory for any vendor-provided workarounds before applying them.

Detection guidance

  • Review application and web server logs for unusual or malformed values sent to timestamp-related parameters.
  • Monitor database error messages that reference query syntax issues from the application.
  • Correlate such events with the account and source address to support incident triage.

Limitations of the available information

  • The record does not include structured affected version ranges or fixed-version metadata.
  • No technical proof-of-concept details or exploitation timelines are provided in the record.
  • The EPSS probability (0.00377) and percentile (0.29849) are provided, but they are statistical estimates and do not confirm exploitation.

Frequently asked questions

What is CVE-2026-52785?

It is a critical SQL injection vulnerability in the timestamps functionality of OpenProject, affecting versions prior to 17.3.3 and 17.4.1 according to the description.

Which versions fix the issue?

The description states that the issue is fixed in versions 17.3.3 and 17.4.1.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Upgrade to a fixed version as described, restrict access where an upgrade is delayed, and review logs for anomalous timestamp parameter usage.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.