The vulnerability allows a registered administrator to execute arbitrary system commands on the server running OpenProject. It stems from insufficient validation of the sendmail binary path that the application later uses when sending a test e‑mail. This introduces a command injection flaw (CWE‑77) that can lead to full control over the installation, data, and network.

The flaw affects OpenProject 16.6.1 and older. The issue is tied to the administrative interface that permits configuration of the sendmail binary path and the ability to send test e‑mails. No other products or prior versions are cited as vulnerable.

The CVSS score is 8.6, indicating high severity. The EPSS score is below 1 %, pointing to a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers must have authenticated administrative privileges and can inject arbitrary commands once they set the sendmail path and trigger the test e‑mail function.