Configuration Manipulation Vulnerability in Tuleap Software Suite

CVE-2025-27094

What is CVE-2025-27094?

A vulnerability in Tuleap allows a malicious user with access to a tracker to manipulate field configurations. This can lead to unintended information loss, including the loss of settings for various field attributes like display time, size, default values, and row/column configurations in saved reports. Furthermore, specific versions of Tuleap Community Edition are susceptible to crashes triggered by this exploitation, effectively preventing user access to critical tracker data. The issue has been addressed in Tuleap Community Edition version 16.4.99.1739877910 and Tuleap Enterprise Edition versions 16.3-9 and 16.4-4.

References