CVE-2026-32703 — AI Deep Analysis Summary

🚨 **Essence**: Stored XSS in OpenProject's **Repositories** module. 📉 **Consequences**: Attackers inject malicious scripts via **unescaped filenames**.…

🛡️ **Root Cause**: **CWE-79** (Improper Neutralization of Input During Web Page Generation). 🐛 **Flaw**: The system fails to properly **escape/display** filenames in the Repositories module.…

📦 **Affected Products**: **OpenProject** (by opf). 📅 **Vulnerable Versions**: < 16.6.9, < 17.0.6, < 17.1.3, and < 17.2.1. 📌 **Component**: Specifically the **Repositories** module handling file uploads/names.…

💻 **Hacker Actions**: Execute arbitrary JavaScript in victim's browser. 🕵️ **Privileges**: Steal **cookies**, **session tokens**, or **personal data**.…

🔒 **Threshold**: Medium. 🛑 **Auth Required**: Yes, **PR:L** (Low Privileges) needed. Attacker must be a **logged-in user**. 🤝 **UI Required**: Yes, **UI:R** (User Interaction) needed.…

🚫 **Public Exploit**: **No**. The `pocs` array is empty in the data. 📰 **Advisory**: Confirmed via GitHub Security Advisory (GHSA-p423-72h4-fjvp).…

🔍 **Self-Check**: Scan for **OpenProject** instances running versions < 17.2.1. 📂 **Manual Test**: Upload a file with a **script tag** in the filename (e.g., `<img src=x onerror=alert(1)>`).…

✅ **Official Fix**: **Yes**. Patched in **OpenProject 17.2.1** (and earlier minor updates). 🔄 **Action**: Upgrade immediately to the latest stable version.…

🚧 **No Patch Workaround**: 1. **Restrict Access**: Limit Repository module access to trusted admins only. 2. **Input Sanitization**: Manually sanitize filenames before upload (if possible via custom hooks). 3.…

🔥 **Urgency**: **High**. 📅 **Published**: 2026-03-18. 📈 **CVSS**: High (H) impact on Confidentiality, Integrity, Availability. 🚀 **Priority**: Patch immediately upon upgrade.…