What is CVE-2025-27099?

CVE-2025-27099 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2025-03-03.

How severe is CVE-2025-27099?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Enalean Tuleap

CVE-2025-27099

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740067916 and Tuleap Enterprise Edition 16.4-5 and 16.3-10.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (19.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L.

Affected products

Enalean Tuleap — versions < 16.4.99.1740067916

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Exploit, x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2025-27099?: CVE-2025-27099 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2025-03-03.
How severe is CVE-2025-27099?: Medium severity. CVSS v3 base score is 4.8 out of 10.