Cross-Site Scripting Vulnerability in Tuleap Software Development Suite

CVE-2025-27099

What is CVE-2025-27099?

Tuleap, an open-source software development suite, has a vulnerability that allows cross-site scripting (XSS) through the tracker names in semantic timeframe deletion messages. This flaw enables a tracker administrator to potentially execute malicious code on the systems of other administrators using valid semantic timeframes. The issue affects various versions of Tuleap but has been addressed in the latest releases for both Community and Enterprise editions.

References