Description

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-10-12T11:17:09.807Z",
  "pubdate": "2026-10-12T11:17:09.807Z",
  "executiveSummary": "A Stored Cross-site Scripting (XSS) vulnerability has been identified in Tuleap Enterprise Edition versions 17.0 through 17.5. This security flaw allows a remote, authenticated attacker to inject and persist malicious client-side scripts within the application's environment.\nThe vulnerability manifests when user-supplied input is improperly sanitized before being stored in the database and subsequently rendered to other users. Successful exploitation results in the execution of arbitrary JavaScript code within the context of the victim's browser session.\nThe impact of this vulnerability is significant, as it enables attackers to perform unauthorized actions on behalf of the victim, access session cookies, exfiltrate sensitive data, or redirect users to malicious domains. The risk is elevated in collaborative environments where multiple users interact with shared project management interfaces. Exploitation does not necessarily require administrative privileges, depending on the visibility and accessibility of the injected payload to other users or administrators within the Tuleap instance.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Tuleap application to implement adequate input validation and output encoding mechanisms for user-supplied data that is persisted server-side. Specifically, the affected versions fail to neutralize executable scripts within input fields or content areas before storing them, violating the principle of least privilege regarding data handling.\nThe attack flow begins when an attacker identifies an input vector—such as a project description, tracker field, or comment section—where the application fails to perform rigorous server-side sanitization. The attacker submits a payload containing malicious HTML tags and JavaScript (e.g., <script>alert(document.cookie)</script>) into the vulnerable field. The application stores this raw payload in the database without modification.\nWhen a legitimate user, such as a project manager or system administrator, views the page containing the malicious input, the server serves the stored payload back to the client. The victim's browser interprets the injected script as legitimate code originating from the trusted Tuleap origin. Because the script executes within the victim's security context, it inherits the session's permissions and access rights.\nThe technical manifestation of this Stored XSS allows for a wide range of post-exploitation activities. An attacker can leverage the JavaScript execution to conduct session hijacking by reading document.cookie, perform unauthorized state-changing operations via forged HTTP requests (CSRF) on behalf of the authenticated victim, or modify the DOM structure of the page to perform phishing attacks or capture user keystrokes. Since the payload is stored persistently, it remains active until the record is deleted or updated with sanitized content, leading to a high potential for broad impact across the user base."
}