PT-2025-54470 · Titra · Titra

Published 2025-12-31 · Updated 2026-01-02 · CVE-2025-69288

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Titra versions prior to 0.99.49

Description Titra is open source project time tracking software. Prior to version 0.99.49, authenticated Admin users can modify the timeEntryRule value in the database. This value is then passed to a NodeVM value to execute as code without sanitization, leading to Remote Code Execution. The timeEntryRule is a vulnerable parameter.

Recommendations Update to version 0.99.49 to address this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-69288

GHSA-PQGX-6WG3-GMVR

Affected Products

Titra

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69288.json · Exploit
• 🔥 https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr · Exploit
• https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-69288 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69288 · Vendor Advisory
• https://github.com/kromitgmbh/titra/releases/tag/0.99.49 · Note
• https://twitter.com/TheHackerWire/status/2006500554399170987 · Twitter Post
• https://twitter.com/CVEnew/status/2006495355471294874 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006540468767658050 · Twitter Post
• https://t.me/CVEtracker/41133 · Telegram Post
• https://t.me/cveNotify/147560 · Telegram Post
• https://twitter.com/0dayPublishing/status/2006488227134206098 · Twitter Post
• https://twitter.com/CveFindCom/status/2006495302174330921 · Twitter Post