PT-2025-13786 · Tuleap · Tuleap

Tgerbet + 1 · Published 2025-03-31 · Updated 2025-08-21 · CVE-2025-29766

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.5.99.1741784483 Tuleap Enterprise Edition versions prior to 16.5-3 and 16.4-8

Description The issue is related to missing CSRF protections on artifact submission and edition from the tracker view. An attacker could exploit this to trick victims into submitting or editing artifacts or follow-up comments.

Recommendations For Tuleap Community Edition versions prior to 16.5.99.1741784483, update to version 16.5.99.1741784483 or later. For Tuleap Enterprise Edition versions prior to 16.5-3, update to version 16.5-3 or later. For Tuleap Enterprise Edition version 16.4, update to version 16.4-8 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-29766

GHSA-6P9Q-P2Q4-3RQX

Affected Products

Tuleap

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29766.json · Exploit
• https://github.com/Enalean/tuleap/commit/81f45330fdcc1329cc71eddf4d04b80c340b3b93 · Patch
• https://osv.dev/vulnerability/CVE-2025-29766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29766 · Security Note
• https://tuleap.net/plugins/tracker/?aid=42208 · Vendor Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-6p9q-p2q4-3rqx · Note
• https://t.me/cvedetector/21622 · Telegram Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=81f45330fdcc1329cc71eddf4d04b80c340b3b93 · Note
• https://twitter.com/CVEnew/status/1906735889725985275 · Twitter Post
• https://t.me/cveNotify/133123 · Telegram Post