OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

The impact of CVE-2026-32703 is significant due to its persistent nature and broad reach within a project. An attacker can craft a commit with a specially designed filename containing malicious HTML. When a project member views the changeset page displaying this file, the injected script executes in their browser context. This allows the attacker to potentially steal session cookies, redirect users to phishing sites, or deface the OpenProject interface. The attack is persistent because the malicious code is stored within the repository's history, meaning it can affect users repeatedly until the affected commits are removed or the vulnerability is patched. This vulnerability shares similarities with other XSS attacks where unsanitized user input is reflected back to the user, but the repository context adds a layer of persistence.

Organizations using OpenProject for project management, particularly those with multiple users and shared repositories, are at risk. Teams relying on OpenProject for sensitive project data are especially vulnerable, as the XSS attack could lead to data theft or unauthorized access. Users with push access to repositories represent the most immediate threat.

• linux / server: Monitor OpenProject logs for unusual activity related to repository commits. Use journalctl -f to observe repository access patterns and look for suspicious filenames.

journalctl -f | grep 'repository commit' | grep -i 'html'

• generic web: Examine OpenProject access and error logs for requests containing suspicious HTML code in filenames. Use curl to test repository endpoints with crafted filenames and observe the response for signs of XSS.

curl 'https://openproject.example.com/repositories/your_repo/commits?filename=<script>alert("XSS")</script>' -s

1. 2026-03-18Disclosure

   disclosure

1. Reserviert2026-03-13
2. Veröffentlicht2026-03-18
3. Geändert2026-03-19
4. EPSS aktualisiert2026-03-26

The primary mitigation for CVE-2026-32703 is to upgrade OpenProject to version 17.2.1 or later, which contains the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. While a WAF might offer some protection, it's unlikely to be effective against this specific vulnerability due to the nature of the repository data. Carefully review repository commit history for any suspicious filenames that might indicate exploitation. Implement stricter access controls to limit push access to the repository to only authorized personnel. After upgrading, confirm the fix by attempting to create a commit with a malicious filename and verifying that the HTML is properly sanitized and not rendered in the changeset page.