CVE-2025-27156

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail...

CVE-2025-27402 Tuleap is missing CSRF protections on tracker fields administrative operations

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability i...

CVE-2025-27402 Tuleap is missing CSRF protections on tracker fields administrative operations

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability i...

CVE-2025-27402 Tuleap is missing CSRF protections on tracker fields administrative operations

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability i...

CVE-2025-27402

CVE-2025-27402 affects Tuleap, an open-source software lifecycle and collaboration suite. The vulnerability is a missing CSRF protection on tracker fields administrative operations, enabling an attacker to trick victims into removing or updating tracker fields. Affected code and impact are descri...

CVE-2025-27401 In Tuleap, deleting a report can delete criteria filters in other reports

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the...

CVE-2025-27401 In Tuleap, deleting a report can delete criteria filters in other reports

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the...

CVE-2025-27401 In Tuleap, deleting a report can delete criteria filters in other reports

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the...

CVE-2025-27401

CVE-2025-27401 affects Tuleap (Open Source Suite). A malicious user with access to one tracker can delete a report, which may also delete criteria filters for other reports, causing loss of standard filters and forcing admins/users to recreate them. Concrete details: affected software is Tuleap C...

CVE-2025-27156

Tuleap CVE-2025-27156 affects the mass emailing feature, where HTML content in emails is not sanitized, enabling content injection that could facilitate phishing or indirect exploitation of recipients’ mail clients. Affected versions include Tuleap Community Edition prior to 16.4.99.1740567344 an...

CVE-2025-27156 Tuleap allows content injection via emails sent by the mass emailing features

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail...

CVE-2025-27156 Tuleap allows content injection via emails sent by the mass emailing features

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail...

CVE-2025-27156 Tuleap allows content injection via emails sent by the mass emailing features

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail...

CVE-2025-27150 Tuleap dumps the Redis password into the generated troubleshooting archives

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access t...

CVE-2025-27150 Tuleap dumps the Redis password into the generated troubleshooting archives

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access t...

CVE-2025-27150

This CVE concerns Tuleap: the password used to connect to the Redis instance is not purged from the archives created by tuleap collect-system-data. The exposed password could be accessed by support teams who should not have it. Affected versions: Tuleap Community Edition prior to 16.4.99.17404928...

CVE-2025-27150 Tuleap dumps the Redis password into the generated troubleshooting archives

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access t...

Tuleap 跨站请求伪造漏洞

Tuleap is an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A cross-site request forgery vulnerability exists in Tuleap Community Edition prior to 16.4.99.1740414959 and Tuleap Enterprise Edition prior to 16.4-6, and prior ...

PT-2025-9690 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 16.4.99.1740414959 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11 Description: The issue is related to the lack of CSRF protections on tracker fields administrative operations in Tuleap. This allows an...

Tuleap 安全漏洞

Tuleap is an open source suite from Enalean Open Source designed to improve the management of software development and collaboration. A security vulnerability exists in Tuleap Community Edition prior to 16.4.99.1740498975 and Tuleap Enterprise Edition prior to 16.4-6, and prior to 16.3-11, which...