OpenProject 16.3.0 through 16.6.4 contain a stored cross‑site scripting flaw in the Roadmap view. The view renders a list of related work packages for each project version, and when a version includes work packages from a different project, a helper function prepends the project name to the link and marks the entire string as safe HTML. Because project names are user‑controlled and no escaping occurs before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. This flaw enables an attacker to execute arbitrary scripts in the browser of any user who opens the affected roadmap. Based on the description, it is inferred that such scripts could hijack sessions, steal credentials, or deface the interface.

OpenProject released under an open‑source license is affected. Versions 16.3.0 up to and including 16.6.4 contain the vulnerability. The issue was mitigated in versions 16.6.5 and 17.0.0 by including an X‑Content‑Type‑Options: nosniff header and correcting the content‑security‑policy configuration. Installations that cannot upgrade should ensure that a nosniff header is added by their front‑end or reverse proxy.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to create or modify a subproject name containing malicious HTML, requiring either administrative access to the project interface or compromise of the database. Once a victim opens the roadmap page, the injected script runs with the victim user’s privileges.