CVE-2025-27099

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740067916 and Tuleap Enterprise Edition 16.4-5 and 16.3-10.

• CWE-79
• CWE-80
• CWE-79

• https://github.com/Enalean/tuleap/commit/bec10bd5c98f6570a2857f55e9656eec4b211e6cPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-vqfj-2gqp-g89xPatch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=41858Exploit, Issue Tracking, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=41858Exploit, Issue Tracking, Vendor Advisory

Published

Mar 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27093Sliver is a command and control framework that uses a custom…6.3
• CVE-2025-27094Tuleap is an open-source suite designed to improve software …5.4
• CVE-2025-27095JumpServer is an open source bastion host and an operation a…4.3
• CVE-2025-27096WeGIA is a Web Manager for Institutions with a focus on Port…9.8
• CVE-2025-27097GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
• CVE-2025-27098GraphQL Mesh is a GraphQL Federation framework and gateway f…7.5
• CVE-2025-2710A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and cla…6.1
• CVE-2025-27100lakeFS is an open-source tool that transforms your object st…6.5
• CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
• CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
• CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
• CVE-2025-27104vyper is a Pythonic Smart Contract Language for the EVM. Mul…7.5