PT-2025-49606 · Unknown · Tuleap Community Edition+1

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-64498

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1762444754 Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10

Description Tuleap is an Open Source Suite for management of software development and collaboration. Attackers can potentially trick victims into changing tracker general settings.

Recommendations Update Tuleap Community Edition to version 17.0.99.1762444754. Update Tuleap Enterprise Edition to version 17.0-2. Update Tuleap Enterprise Edition to version 16.13-7. Update Tuleap Enterprise Edition to version 16.12-10.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64498

GHSA-VXFH-H8P6-P5RG

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64498.json · Exploit
• https://github.com/Enalean/tuleap/commit/993316dd6a291bb3937cb7a4571eaab0e7d55370 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-vxfh-h8p6-p5rg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64498 · Security Note
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=993316dd6a291bb3937cb7a4571eaab0e7d55370 · Patch
• https://tuleap.net/plugins/tracker/?aid=45593 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64498 · Vendor Advisory
• https://t.me/cveNotify/145215 · Telegram Post
• https://twitter.com/CVEnew/status/1998163810750976122 · Twitter Post