PT-2025-49605 · Unknown · Tuleap Enterprise Edition+1

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-64497

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1762431347 Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7, and 16.12-10

Description Tuleap is an Open Source Suite for management of software development and collaboration. Insufficient access controls in versions below 17.0.99.1762431347 of Tuleap Community Edition and below 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition allow attackers to access file release system information in projects to which they do not have authorized access.

Recommendations Update Tuleap Community Edition to version 17.0.99.1762431347 or later. Update Tuleap Enterprise Edition to version 17.0-2, 16.13-7, or 16.12-10 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-64497

GHSA-V6VM-6RXF-7P2V

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64497.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v · Vendor Advisory
• https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254 · Patch
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254 · Patch
• https://osv.dev/vulnerability/CVE-2025-64497 · Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=45583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64497 · Security Note
• https://t.me/cveNotify/145214 · Telegram Post
• https://twitter.com/CVEnew/status/1998163811912855775 · Twitter Post