CVE-2026-84285
HighCVSS 8.8Summary
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
Risk Assessment
An attacker could execute arbitrary commands on the server, potentially leading to full system compromise. Risk applies to organizations using Tuleap Enterprise Edition versions 17.3–17.5.
Recommendation
Upgrade Tuleap Enterprise Edition to a version later than 17.5. If upgrade is not possible, consider restricting access to the application and monitoring for unusual commands.
Other vulnerabilities in Tuleap Enterprise Edition
See all- CVE-2026-19851High
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
- CVE-2026-14165High
The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.
Original NVD description (English source)
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.