CVE-2025-27156
Tuleap allows content injection via emails sent by the mass emailing features
- State
- Published
- Severity
- 4.1 Medium
- Published
- Mar 4, 2025
- Updated
- Mar 4, 2025
- Reserved
- Feb 19, 2025
Description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.1 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N | GitHub_M |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
tuleapEnalean |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.