OpenProject versions prior to 16.6.6 and 17.0.2 contain a command‑line argument injection flaw in the repository diff download endpoint when rendering a single revision via git show. A crafted rev parameter such as rev=--output=/tmp/poc.txt causes the underlying Git command to treat the attacker‑controlled value as an option and write its output to a user‑specified path. The write operation runs under the OpenProject process user, allowing creation or overwriting of any file the process can write, which can corrupt application or configuration files and lead to data loss or denial of service.

The vulnerability affects installations of OpenProject, specifically any version older than 16.6.6 or 17.0.2. Any user possessing the :browse_repository permission on a project may trigger the flaw, regardless of other privileges.

The CVSS score of 9.4 signals critical severity, while an EPSS score of <1% indicates a low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw remotely via the web interface by providing a malicious rev parameter, provided they have repository browsing rights; the resulting arbitrary file write can compromise integrity and availability of the system.