CVE-2026-34717

CRITICAL

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-34717 has a selected CVSS score of 9.9 (critical).

Description

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 3, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

openproject

Browse opf / openproject
CVE List< 17.2.3affected

References

2