PT-2025-44207 · Taiga · Taiga

Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-62367

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Taiga versions prior to 6.9.0

Description Taiga, an open source project management platform, has an issue in its API. Versions 6.8.3 and earlier are susceptible to time-based blind SQL injection, potentially leading to the disclosure of sensitive data through response timing. The API endpoint is vulnerable due to this injection flaw. The vulnerable parameter is not specified.

Recommendations Update to version 6.9.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-62367

GHSA-CHM9-9WWQ-XFFJ

Affected Products

Taiga

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62367.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62367 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62367 · Vendor Advisory
• https://github.com/taigaio/taiga-back/security/advisories/GHSA-chm9-9wwq-xffj · Note
• https://t.me/CVEtracker/35996 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983397318234718661 · Twitter Post
• https://twitter.com/CVEnew/status/1983273376010457408 · Twitter Post