XSS in Enalean Tuleap
CVE-2025-27099
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740067916 and Tuleap Enterprise Edition 16.4-5 and 16.3-10.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (20.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Enalean Tuleap — versions < 16.4.99.1740067916
Weakness classification (CWE)
References
- github.com/Enalean/tuleap/security/advisories/GHSA-vqfj-2gqp-g89x (Patch, Vendor Advisory)
- github.com/Enalean/tuleap/commit/bec10bd5c98f6570a2857f55e9656eec4b211e6c (Patch)
- tuleap.net/plugins/tracker/ (Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-27099?
- CVE-2025-27099 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2025-03-03.
- How severe is CVE-2025-27099?
- Medium severity. CVSS v3 base score is 4.8 out of 10.