CVE-2026-52780 OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
Attackers can achieve remote code execution in OpenProject by poisoning the cache store, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52780?
CVE-2026-52780 is a critical code injection vulnerability in opf openproject, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.
Weakness: CWE-20
Which versions are affected by CVE-2026-52780?
How do I fix CVE-2026-52780?
No fix has been published for CVE-2026-52780 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-52780 being exploited?
There is no known exploitation of CVE-2026-52780 in the wild and no public exploit code.
Sources
Also known as GHSA-qj96-f42f-6336.