Is CVE-2026-30234 actively exploited?

No active exploitation of CVE-2026-30234 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30234 be exploited remotely?

Yes. CVE-2026-30234 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30234?

CVE-2026-30234 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-30234

MEDIUM

CVE-2026-30234

CWE-22Published: March 11, 2026· Updated: Mar 17, 2026

6.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.3th

Official Description

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the <Snapshot> value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untrusted <Snapshot> value is used as file.path during attachment processing. As a result, local filesystem content can be read outside the intended ZIP scope. This results in an Arbitrary File Read (AFR) within the read permissions of the OpenProject application user. This vulnerability is fixed in 17.2.0.

NVD Source

Technical Analysis

CVE-2026-30234 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.