High severity · published Jan 10, 2026
CVE-2026-22601
OpenProject is an open-source, web-based project management software
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openproject · Openproject
before 16.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22601
Release Notes
https://github.com/opf/openproject/releases/tag/v16.6.2
Vendor Advisory
https://github.com/opf/openproject/security/advisories/GHSA-9vrv-7h26-c7jc
More from Openproject
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.1
CVE-2026-22600
OpenProject is an open-source, web-based project management software
9.0
CVE-2026-24772
OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
8.8
CVE-2026-24685
OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
8.8
CVE-2021-43830
OpenProject is a web-based project management software