What’s Vulnerable › Vulnerabilities

CVE-2025-27156: Tuleap allows content injection via emails sent by the mass emailing features

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-04 · updated 2026-06-17
• Weakness: CWE-79

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Affected products

• Enalean tuleap: before 16.3-11; before 16.4.99.1740567344; from 16.4 before 16.4-6 — fixed in 16.3-11, 16.4-6, 16.4.99.1740567344

How to fix

Upgrade to a fixed version: Enalean tuleap 16.3-11, 16.4-6, 16.4.99.1740567344. Check the vendor advisory for mitigations.

References

• https://github.com/Enalean/tuleap/commit/a0bc657297b405debce1f5bcbbb30c733f3f09bd
• https://github.com/Enalean/tuleap/security/advisories/GHSA-x2v2-xr59-c9cf
• https://tuleap.net/plugins/tracker/?aid=42177

Get alerted when CVE-2025-27156 or the next vulnerability affects your stack