CVE-2025-69288

Titra has Remote Code Execution in Admin Functionality

State: Published
Severity: 9.1 Critical
Published: Dec 31, 2025
Updated: Jan 2, 2026
Reserved: Dec 31, 2025

Description

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
titrakromitgmbh	< 0.99.49Affected

References

https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr
https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e
https://github.com/kromitgmbh/titra/releases/tag/0.99.49

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.