CyberRota Analysis
AI-GeneratedOpenProject versions prior to 17.6.0 are vulnerable to a high-severity issue that allows authenticated users with edit_work_packages permissions to manipulate file links, potentially leading to unauthorized access to sensitive metadata such as filenames and MIME types. This vulnerability enables attackers to detach or delete file links and re-parent them to work packages they control, posing a significant risk to project data integrity. Organizations using affected versions should prioritize upgrading to 17.6.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.