The flaw allows an administrator to insert arbitrary HTML tags into the name of a work package used in time tracking. Because OpenProject does not escape these tags, the injected code is rendered when other users view the time‑tracking list, enabling client‑side code execution in the victim’s browser. This can be used to steal session data, deface pages, or serve malware. The weakness is a classic Stored XSS scenario, reflected in CWE‑80.

OpenProject built by opf:openproject is affected. Versions earlier than 16.6.7 and earlier than 17.0.3 contain the underlying vulnerability; those releases rely on the time‑tracking feature that does not sanitize input.

The exploit requires administrative access to create a malicious work package; thus the attack surface is limited to privileged users. The CVSS score of 3.5 indicates low overall severity, while the EPSS score of below 1% implies a very low probability of commercial exploitation. The issue is not currently listed in the CISA KEV catalog, suggesting no widespread active weaponized attacks at the time of this assessment. Nonetheless, compromised administrator credentials could facilitate a user‑side XSS injection that compromises the integrity and confidentiality of user sessions.