OpenProject, a popular open‑source project management tool, contains a severe SQL injection flaw in the timestamps functionality. The flaw allows an attacker to manipulate the timestamps parameter used for baseline comparisons to inject arbitrary SQL into database queries. Successful exploitation could lead to data disclosure, tampering of work‑package history, or execution of database commands, thereby compromising the confidentiality and integrity of project data.

The vulnerability affects OpenProject deployments running from any release prior to 17.3.3 and 17.4.1. Attackers can target the baseline comparison API exposed through the timestamps field, which is part of the OpenProject core library provided by opf:openproject.

With a CVSS score of 9.9 the flaw is considered critical. The absence of an EPSS score indicates no publicly available exploitation data, and the vulnerability is not yet catalogued in the CISA KEV list. Nevertheless the well‑documented attack surface—in a web form or API—suggests a realistic web‑based exploitation path. If left unpatched, an attacker could achieve persistent data access or manipulation with minimal prerequisites.