OpenProject up to versions 16.6.7 and 17.0.3 contains an arbitrary file write flaw in the repository changes endpoint. By sending a crafted rev value such as rev=--output=/tmp/poc.txt, an attacker can inject git log options and force the OpenProject process to write data to a path of the attacker’s choice. With carefully composed commits, the attacker can place executable shell scripts as the file contents, resulting in remote code execution that allows creation of reverse shells and unrestricted reading of sensitive files like /etc/passwd.

The vulnerability affects OpenProject web‑based project management software before releases 16.6.7 and 17.0.3. Any deployment running these earlier versions is susceptible; the issue is fixed in the stated patched releases.

The CVSS score of 9.4 indicates a high severity vulnerability, while the EPSS score of under 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who has :browse_repository permission on a project; the attacker then submits the crafted rev parameter to the changes endpoint, leading to file write and potentially code execution.