Cross-Site Scripting Vulnerability in Tuleap Software Development Suite

CVE-2025-30203

What is CVE-2025-30203?

Tuleap, an Open Source Suite designed for enhanced software development and collaboration, has a vulnerability that allows cross-site scripting (XSS) through the content of RSS feeds utilized in its RSS widgets. This issue enables a project administrator or an individual controlling the RSS feed to execute arbitrary code, potentially compromising the security of affected systems. The vulnerability has been addressed in Tuleap Community Edition version 16.5.99.1742562878 and Tuleap Enterprise Edition versions 16.5-5 and 16.4-8.

References