CVE-2025-30209

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Enalean	tuleap	< 16.5.99.1742812323

References

https://github.com/Enalean/tuleap/commit/34af2d5d10b0349967129f53427f495815e5bbccPatch
https://github.com/Enalean/tuleap/security/advisories/GHSA-hcp5-pmpm-mgwhThird Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=34af2d5d10b0349967129f53427f495815e5bbccBroken Link
https://tuleap.net/plugins/tracker/?aid=42251Vendor Advisory

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-30218.7Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside th CVE-2025-302106.1Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-toolt CVE-2025-302117.5Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously CVE-2025-302127.5Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 1 CVE-2025-302138.8Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents CVE-2025-302147.5Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information d CVE-2025-302159.6NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior CVE-2025-302169.1CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2025-302177.5Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified i CVE-2025-302185.9Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subreq CVE-2025-302196.1RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual hos CVE-2025-30229.3Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the s