What’s Vulnerable › Vulnerabilities

CVE-2025-69288: Titra has Remote Code Execution in Admin Functionality

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-31 · updated 2026-09-23
• Weakness: CWE-20

Description

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Affected products

• kromitgmbh/titra: before 0.99.49 — fixed in 0.99.49

How to fix

Upgrade to a fixed version: kromitgmbh/titra 0.99.49. Check the vendor advisory for mitigations.

References

• https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e
• https://github.com/kromitgmbh/titra/releases/tag/0.99.49
• https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr
• https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr

Get alerted when CVE-2025-69288 or the next vulnerability affects your stack