CVE-2025-62368

🗓️ 28 Oct 2025 20:08:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 14 Views🌐 WEB

Taiga API remote code execution via unsafe deserialization in versions up to 6.8.3; fixed in 6.9.0.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-62368	28 Oct 202523:12	–	circl
CNNVD	Taiga 代码问题漏洞	28 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-62368 Taiga Authenticated Remote Code Execution	28 Oct 202520:08	–	cvelist
EUVD	EUVD-2025-36562	28 Oct 202520:08	–	euvd
Metasploit	Taiga tribe_gig authenticated unserialize remote code execution	7 Jan 202618:58	–	metasploit
NVD	CVE-2025-62368	28 Oct 202521:15	–	nvd
OSV	CVE-2025-62368 Taiga Authenticated Remote Code Execution	28 Oct 202520:08	–	osv
Packet Storm	📄 Taiga Tribe_gig Authenticated Unserialize Remote Code Execution	7 Jan 202600:00	–	packetstorm
Positive Technologies	PT-2025-44208	28 Oct 202500:00	–	ptsecurity
Rapid7 Blog	Metasploit Wrap-Up 01/09/2026	9 Jan 202623:07	–	rapid7blog

Vulners

Node

taigaio taiga-backRange<6.9.0

[
  {
    "vendor": "taigaio",
    "product": "taiga-back",
    "versions": [
      {
        "version": "< 6.9.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/taigaio/taiga-back/security/advisories/GHSA-cpcf-9276-fwc5

Parameter	Position	Path	Description	CWE
tribe_gig	request body	api/v1/userstories	Unserialize vulnerability via Taiga API by posting a crafted userstory payload containing serialized data to create code-execution payload.	CWE-502

15 Apr 2026 00:35Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19

EPSS0.6408

SSVC

CWE-502