# CVE-2026-52785: OpenProject SQL injection in timestamps functionality

Source: https://junglewise.ai/threats/cve-2026-52785-openproject-sql-injection-in-timestamps-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-52785 · Severity: critical · CVSS 9.9 · Published 2026-06-26

OpenProject, a web-based project management platform, is affected by a critical security flaw in its baseline comparison feature. This feature allows users to view historical changes to project tasks and attributes. An attacker with basic user permissions could exploit this to gain unauthorized access to sensitive project data or modify information, potentially compromising the integrity of the entire project management system.

## Quick answers

**Is CVE-2026-52785 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52785 being exploited in the wild.

**How severe is CVE-2026-52785?** Critical severity, with a CVSS score of 9.9, published 26 June 2026.

**Which products and versions are affected?** opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1.

**Is there a fix for CVE-2026-52785?** A patch was published on 2026-06-08: Fixes released in versions 17.3.3 and 17.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52785 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52785?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in OpenProject's baseline comparison functionality. The flaw is located within the handling of the 'timestamps' parameter, which is used to request historic work-package attributes. An authenticated attacker with low privileges can provide specially crafted input to this parameter to execute arbitrary SQL commands against the backend database. This could lead to full data exfiltration, unauthorized modification of records, and a partial impact on service availability. The vulnerability is addressed in versions 17.3.3 and 17.4.1.

## Affected products

- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1

## Timeline

- 2026-06-08: advisory: Original GitHub security advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-08: patched: Fixes released in versions 17.3.3 and 17.4.1

## References

- [https://github.com/opf/openproject/security/advisories/GHSA-98vw-2r87-fx2r](https://github.com/opf/openproject/security/advisories/GHSA-98vw-2r87-fx2r)