Description

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-10-12T11:17:09.937Z",
  "pubdate": "2026-10-12T11:17:09.937Z",
  "executiveSummary": "This vulnerability is identified as a Stored Cross-site Scripting (XSS) flaw affecting Tuleap Enterprise Edition versions 17.0 through 17.5.\nThe vulnerability occurs due to the improper sanitization of user-supplied input, allowing for the persistence of malicious scripts within the application database.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript within the context of a victim's browser session, potentially leading to unauthorized actions on behalf of the user, session hijacking, or data exfiltration.\nThe risk is significant for organizations relying on Tuleap for collaborative project management, as the Stored XSS vector can target any authenticated user or administrator viewing the compromised content.\nExploitation does not necessarily require highly sophisticated tools, as the primary requirement is the ability to inject payload content into areas of the application that subsequently render the input without adequate escaping.\nThe security impact includes the compromise of integrity and confidentiality for user sessions, which could be leveraged to escalate privileges or gain persistent access to sensitive project data within the Tuleap environment.",
  "technicalDetails": "The vulnerability resides in the application's failure to adequately neutralize untrusted user input before it is stored in the underlying database and subsequently rendered in the Tuleap interface. This is a classic Stored XSS (persistent XSS) condition, where the malicious payload is saved server-side and served to other users without sanitization.\nRoot cause: The vulnerability stems from insufficient output encoding or improper input filtering within the web application layer. When the application accepts data from a user—such as in issue descriptions, comments, or custom fields—it fails to filter out executable script tags or attribute-based event handlers (e.g., onerror, onload, or javascript: pseudo-protocols).\nAttack flow: An attacker initiates the exploitation by submitting a crafted payload into an input field that the application processes and persists. Upon submission, the Tuleap backend stores the malicious script directly in the database. When a legitimate user (such as a project manager or another contributor) navigates to the view containing the infected entry, the application retrieves the malicious script from the database and embeds it into the HTML document delivered to the victim's browser.\nPayload execution: Because the script is delivered within the legitimate origin of the Tuleap instance, the victim's browser executes the code under the authority of the user's active session. This bypasses typical browser-based security boundaries, allowing the attacker to interact with the DOM, access cookies (if the HttpOnly flag is not strictly enforced), and make unauthorized API calls to the Tuleap back-end.\nAffected versions: The vulnerability affects Tuleap Enterprise Edition from version 17.0 up to and including version 17.5.\nPost-exploitation: The impact of this XSS vulnerability is broad. An attacker can hijack the victim's session tokens to perform unauthorized actions such as deleting projects, modifying issue statuses, or exfiltrating sensitive documentation. Furthermore, the attacker could use the XSS to rewrite the page content, redirect users to external phishing sites, or perform 'browser-in-the-middle' attacks to capture form data submitted by the victim during the duration of the compromised session.\nThis vulnerability highlights the need for robust input validation and context-aware output encoding across all user-controllable input vectors within the Tuleap ecosystem."
}