CVE-2026-52780CWE-20

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

Critical · published June 26, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
32.0
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00390 · 32.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-06-26T19:09Z
EPSS history
Timeline
  • 26 JUN 19:09Z
    OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
    cvelistv5