CVE-2025-64117

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1761813675, Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue.

• CWE-352

• https://github.com/Enalean/tuleap/commit/f49419f63edbbaa31ce8417b737431d944827404
• https://github.com/Enalean/tuleap/security/advisories/GHSA-p2f7-qw8p-f2p7
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f49419f63edbbaa31ce8417b737431d944827404
• https://tuleap.net/plugins/tracker/?aid=45251

Published

Nov 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64111Gogs is an open source self-hosted Git service. In version 0…9.8
• CVE-2025-64112Statmatic is a Laravel and Git powered content management sy…8
• CVE-2025-64113Emby Server is a user-installable home media server. Version…9.8
• CVE-2025-64114ClipBucket v5 is an open source video sharing platform. Vers…6.5
• CVE-2025-64115Movary is a web application to track, rate and explore your …6.1
• CVE-2025-64116Movary is a web application to track, rate and explore your …6.1
• CVE-2025-64118node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list…6.1
• CVE-2025-64119A vulnerability in Nuvation Battery Management System allows…9.3
• CVE-2025-6412A vulnerability was found in PHPGurukul Art Gallery Manageme…8.8
• CVE-2025-64120Improper Neutralization of Special Elements used in an OS Co…8.8
• CVE-2025-64121Authentication Bypass Using an Alternate Path or Channel vul…9.8
• CVE-2025-64122Insufficiently Protected Credentials vulnerability in Nuvati…5.5