Critical · published January 10, 2026
🔥 A sneaky SVG masquerading as a PNG can expose sensitive files during PDF exports! Think of it like a delivery service that accepts any package, regardless of what's inside — a disguised parcel could reveal your entire project’s secrets when it arrives at the destination. This vulnerability allows attackers to read any local files they have access to, potentially exposing sensitive configuration files or private project data! Imagine unexpected blueprints of your secret projects ending up in the wrong hands. Absolutely devastating!
Think of it like a delivery service that accepts any package, regardless of what's inside — a disguised parcel could reveal your entire project’s secrets when it arrives at the destination. This Local File Read (LFR) vulnerability in OpenProject leverages the backend image processing of ImageMagick when exporting work packages to PDF. By uploading a specially crafted SVG file as an image, an attacker can trigger file reading operations that should be restricted.
This vulnerability allows attackers to read any local files they have access to, potentially exposing sensitive configuration files or private project data! Imagine unexpected blueprints of your secret projects ending up in the wrong hands. Absolutely devastating! Upgrade to OpenProject version 16.6.4 immediately to secure your installation. If an upgrade isn't feasible right now, be sure to apply the patch manually to mitigate the risk of exploitation. Don't leave your projects vulnerable! You've got this! Follow these steps to safeguard your data and elevate your security hero status! 🛡️