PT-2025-44208 · Taiga · Taiga

Published 2025-10-28 · Updated 2026-01-10 · CVE-2025-62368

Positive Technologies · (AI Summary)

CVSS v3.1

9.0

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Taiga versions 6.8.3 and earlier

Description Taiga is an open source project management platform. A remote code execution issue exists in the Taiga API due to unsafe deserialization of untrusted data. An attacker can execute arbitrary code remotely, potentially taking control of affected systems. The API is susceptible to this issue. The vulnerability arises from the deserialization of untrusted data.

Recommendations Versions prior to 6.9.0 should be updated to version 6.9.0.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-62368

GHSA-CPCF-9276-FWC5

Affected Products

Taiga

References · 11

• https://osv.dev/vulnerability/CVE-2025-62368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62368 · Security Note
• https://github.com/taigaio/taiga-back/security/advisories/GHSA-cpcf-9276-fwc5 · Note
• https://reddit.com/r/SecOpsDaily/comments/1q8opwj/metasploit_wrapup_01092026 · Reddit Post
• https://twitter.com/CVEnew/status/1983273374982787263 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983384519576084607 · Twitter Post
• https://twitter.com/CveTodo/status/1983284816716910617 · Twitter Post
• https://twitter.com/0dayPublishing/status/1983268657665814786 · Twitter Post
• https://twitter.com/CveFindCom/status/1983272571966566457 · Twitter Post
• https://t.me/poxek/5651 · Telegram Post
• https://t.me/CVEtracker/36001 · Telegram Post