The vulnerability is a cache store poisoning flaw that allows an attacker to inject malicious data into the cache, which is later interpreted as executable code by the application. This weakness leads directly to Remote Code Execution, giving an attacker full control over the affected system. The flaw is classified under CWE‑20, indicating improper input validation and lack of trust in cached data.

OpenProject, versions prior to 17.3.3 and 17.4.1, is affected. The vendor identified the product as opf:open affected release must consider upgrading to a patched version.

The CVSS score of 9.6 reflects the high severity of this RCE flaw. EPSS information is not available, so the likelihood of exploitation cannot be quantified, but the absence of KEV listing suggests it has not yet been observed in the wild. The attack vector is inferred to be via compromise of the cache store, which could be accessed over the network or by a malicious user with sufficient privileges inside the application stack.