CVE-2025-64117
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 lack cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could exploit this vulnerability to trick victims into changing the commit rules or immutable tags of an SVN repository.
Risk Assessment
An attacker could alter commit rules or immutable tags in an SVN repository, potentially leading to unauthorized code changes or repository integrity compromise. This requires victim interaction but can have serious consequences for the software development process.
Recommendation
Update Tuleap Community Edition to version 16.13.99.1761813675 or Tuleap Enterprise Edition to version 16.13-5 or 16.12-8. Remind administrators about the risk of clicking unknown links.
Other vulnerabilities in Tuleap
See all- CVE-2026-105407High
An OS Command Injection vulnerability in Tuleap Enterprise Edition from 17.0 through 17.5 allows an attacker to execute arbitrary commands on the server.
- CVE-2025-65962Medium
Vulnerability in Tuleap (Community Edition before 17.0.99.1763803709 and Enterprise Edition before 17.0-4 and 16.13-9) due to missing CSRF protections in tracker field dependencies, allowing attackers to modify tracker fields.
- CVE-2025-64760Medium
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
- CVE-2025-64499Medium
Tuleap Community Edition prior to version 17.0.99.1762456922 and Tuleap Enterprise Edition prior to versions 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through the planning management API. Attackers can create, edit, or remove plans.
- CVE-2025-64498Medium
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers to trick victims into changing tracker general settings. This issue is fixed in Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.
- CVE-2025-64497Medium
Tuleap Community Edition versions below 17.0.99.1762431347 and Tuleap Enterprise Edition versions below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Enterprise Edition.
- CVE-2025-64482Medium
Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 lack cross-site request forgery protections in the file release system. An attacker could exploit this vulnerability to trick victims into changing the commit rules or immutable tags of an SVN repository.
- CVE-2025-54877Medium
In Tuleap, an attacker can access the content of special, always-present fields of accessible artifacts even when permissions associated with the underlying fields do not allow it. The issue was fixed in Tuleap Community Edition 16.10.99.1754050155 and Tuleap Enterprise Edition 16.9-8 and 16.10-5.
- CVE-2023-35938Medium
Tuleap has an issue with managing user permissions after changing project visibility. Restricted users who were project administrators before the visibility switch retain access to the project and can perform administrative actions.
Original NVD description (English source)
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1761813675, Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS