Administrator-context script execution via unsanitized report headers

Stored XSS in affected OpenProject Cost Report releases allows remote authenticated users to execute JavaScript in an administrator's browser. The Cost Report table passes attacker-controlled custom-field header values through tablesorter's {icon} substitution without proper sanitization, while a ticket attachment hosts the script to evade the content security policy. Exploitation requires Edit work packages and Add attachments permissions plus an administrator opening the crafted report, enabling an attempted privilege escalation.