CVE-2025-64498

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Enalean	tuleap	Tuleap Community Edition < 17.0.99.1762444754; Tuleap Enterprise Edition < 17.0-2; Tuleap Enterprise Edition < 16.13-7; Tuleap Enterprise Edition < 16.12-10

References

https://github.com/Enalean/tuleap/commit/993316dd6a291bb3937cb7a4571eaab0e7d55370Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-vxfh-h8p6-p5rgVendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=993316dd6a291bb3937cb7a4571eaab0e7d55370Broken Link, Patch
https://tuleap.net/plugins/tracker/?aid=45593Issue Tracking, Vendor Advisory

Timeline

Published: Dec 8, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644995.4Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 1 CVE-2025-64509.8A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an u CVE-2025-645007.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines CVE-2025-645017.6ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirro CVE-2025-645026.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provi CVE-2025-645033.3cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other tha CVE-2025-645045.0Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, CVE-2025-645056.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-645066.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-645077.8Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environ CVE-2025-645087.5Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zer CVE-2025-645097.5Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink t