Skip to content
OpenAdvisories
Critical · 9.6 CVE-2026-52780 EUVD-2026-39874

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

Published Jun 26, 2026 · Updated Jun 27, 2026 · Assigned by GitHub_M

Vendor: opf Product: openproject

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.

Affected products

VendorProductAffectedFixed
opf openproject < 17.3.3, >= 17.4.0, < 17.4.1 —

References