PT-2025-49608 · Tuleap · Tuleap

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-64760

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 17.0.99.1763126988 Tuleap versions prior to 17.0-3 Tuleap versions prior to 16.13-8

Description Tuleap, a free and open source suite for software development and collaboration, is affected by missing Cross-Site Request Forgery (CSRF) protections. This allows attackers to create or remove tracker triggers.

Recommendations Update Tuleap Community Edition to version 17.0.99.1763126988. Update Tuleap Enterprise Edition to version 17.0-3. Update Tuleap Enterprise Edition to version 16.13-8.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64760

GHSA-F2XV-X3G6-4J9P

Affected Products

Tuleap

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64760.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-f2xv-x3g6-4j9p · Vendor Advisory
• https://github.com/Enalean/tuleap/commit/71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64760 · Security Note
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4 · Patch
• https://osv.dev/vulnerability/CVE-2025-64760 · Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=45618 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998174133062889769 · Twitter Post
• https://t.me/cveNotify/145217 · Telegram Post