Medium severity · published Feb 10, 2025
CVE-2025-24892
OpenProject is open-source, web-based project management software
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openproject · Openproject
before 15.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24892
Patch
https://github.com/opf/openproject/pull/17783
Patch
https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j
Patch
https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
Release Notes
https://www.openproject.org/docs/release-notes/12-5-1
More from Openproject
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.1
CVE-2026-22600
OpenProject is an open-source, web-based project management software
9.0
CVE-2026-24772
OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
8.8
CVE-2026-24685
OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
8.8
CVE-2021-43830
OpenProject is a web-based project management software