CVE-2025-62367
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Taiga, an open source project management platform, in versions 6.8.3 and earlier is vulnerable to time-based blind SQL injection, allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
Risk Assessment
An attacker may exfiltrate sensitive data from the database, such as credentials or project information, potentially leading to confidentiality breaches.
Recommendation
Update Taiga to version 6.9.0 or later to remediate the SQL injection vulnerability.
Other vulnerabilities in Taiga
See all- CVE-2026-65055Medium
Vulnerability in Taiga 6.10.1 due to missing authorization in filters_data API endpoints. An unauthenticated attacker can disclose the full member roster and workflow configuration of private projects by supplying a project ID.
- CVE-2026-59097Medium
Taiga before version 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project. The attack exploits unprotected POST endpoints on the user-story, task, and issue due-date API viewsets.
Original NVD description (English source)
Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injection allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS