The vulnerability enables authenticated users with BCF import permissions to upload a crafted .bcf file containing a <Snapshot> element that specifies an absolute or traversal path. During import, the application uses this untrusted value directly as a file path for attachment processing, allowing the reader to access files outside the intended ZIP scope. Because the attack exploits path traversal (CWE‑22), it results in an Arbitrary File Read of any file readable by the OpenProject application user, potentially exposing sensitive system configuration or user data.

The defect is present in all OpenProject releases prior to version 17.2.0. The software vendor’s CNA lists the affected vendor as opf:openproject, with the product name OpenProject. The vulnerability is fixed in release 17.2.0; any version before that is vulnerable.

The CVSS v3.1 base score of 6.5 indicates moderate severity. The EPSS score is below 1%, signalling a low likelihood of exploitation at this time. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires an authenticated project member with BCF import rights; the attacker must create a malicious .bcf archive and upload it to trigger the path traversal. Because the attack is local to the application’s file system, it does not allow remote code execution, but can lead to confidentiality breaches if sensitive files are read.