CVE-2025-48991

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.

• CWE-352

• https://github.com/Enalean/tuleap/commit/cbf9b2a38e33dfd755dc2ccf074126b598a78274Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-px9r-875r-w534Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=cbf9b2a38e33dfd755dc2ccf074126b598a78274Broken Link
• https://tuleap.net/plugins/tracker/?aid=43326Vendor Advisory

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48986Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and …8.8
• CVE-2025-48987Improper Neutralization of Input in Revive Adserver 5.5.2 an…6.1
• CVE-2025-48988Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2025-48989Improper Resource Shutdown or Release vulnerability in Apach…7.5
• CVE-2025-4899A vulnerability was found in Campcodes Sales and Inventory S…9.8
• CVE-2025-48990NeKernal is a free and open-source operating system stack. V…8.6
• CVE-2025-48992Group-Office is an enterprise customer relationship manageme…4.8
• CVE-2025-48993Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2025-48994SignXML is an implementation of the W3C XML Signature standa…6.9
• CVE-2025-48995SignXML is an implementation of the W3C XML Signature standa…6.9
• CVE-2025-48996HAX open-apis provides microservice apis for HAX webcomponen…5.3
• CVE-2025-48997Multer is a node.js middleware for handling `multipart/form-…8.7