What’s Vulnerable › Vulnerabilities

CVE-2025-29766: Tuleap has missing CSRF protections on artifact submission & edition from the tracker view

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-31 · updated 2026-06-17
• Weakness: CWE-352

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.

Affected products

• Enalean tuleap: before 16.4-8; before 16.5.99.1741784483; from 16.5 before 16.5-3 — fixed in 16.4-8, 16.5-3, 16.5.99.1741784483

How to fix

Upgrade to a fixed version: Enalean tuleap 16.4-8, 16.5-3, 16.5.99.1741784483. Check the vendor advisory for mitigations.

References

• https://github.com/Enalean/tuleap/commit/81f45330fdcc1329cc71eddf4d04b80c340b3b93
• https://github.com/Enalean/tuleap/security/advisories/GHSA-6p9q-p2q4-3rqx
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=81f45330fdcc1329cc71eddf4d04b80c340b3b93
• https://tuleap.net/plugins/tracker/?aid=42208

Get alerted when CVE-2025-29766 or the next vulnerability affects your stack