CVE-2025-53541

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3, malicious users with some control over certain artifacts could insert malicious code when displaying the children of a parent artifact to force victims to execute the uncontrolled code. This is fixed in version Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Enalean	tuleap	Tuleap Community Edition < 16.9.99.1751892857; Tuleap Enterprise Edition >= 16.9, < 16.9-3; Tuleap Enterprise Edition < 16.8-5

References

http://github.com/Enalean/tuleap/commit/c1aec8247697d63dc4af791ecd6bd70d105ded08Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-6r66-j76j-rwhwVendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c1aec8247697d63dc4af791ecd6bd70d105ded08Permissions Required
https://tuleap.net/plugins/tracker/?aid=43693Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=43693Vendor Advisory

Timeline

Published: Jul 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-535427.7Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS pa CVE-2025-535434.2Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper CVE-2025-535447.5Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. CVE-2025-535456.9Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). User CVE-2025-535469.1Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploi CVE-2025-535478.6Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Char CVE-2025-535487.5Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are suscept CVE-2025-535495.2The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the CVE-2025-535579.8A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-535588.7ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an CVE-2025-535597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - CVE-2025-53569.8A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component