Description

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-10-12T11:17:10.063Z",
  "pubdate": "2026-10-12T11:17:10.063Z",
  "executiveSummary": "Tuleap Enterprise Edition versions 17.0 through 17.5 contain a Stored Cross-site Scripting (XSS) vulnerability. This security flaw enables a remote attacker to inject arbitrary malicious scripts into the application, which are subsequently stored and executed within the context of a victim's browser session.\nThe vulnerability represents a significant risk as it allows for the potential hijacking of user sessions, unauthorized execution of actions on behalf of the user, and the exfiltration of sensitive data such as session cookies or CSRF tokens. Because the payload is persistent, any user who views the compromised content becomes a target, making this an effective vector for lateral movement or credential theft within the Tuleap environment.\nExploitation requires the attacker to successfully inject the script through an input field that fails to properly sanitize user-supplied data before rendering it in the browser. No specific user interaction beyond viewing the affected content is typically required. Organizations using affected versions should prioritize updates or apply appropriate input validation filters to mitigate the risk of unauthorized client-side script execution.",
  "technicalDetails": "The vulnerability is identified as a Stored XSS issue stemming from improper neutralization of input during web page generation. In Tuleap Enterprise Edition versions 17.0 to 17.5, the application fails to adequately sanitize or encode user-supplied data before storing it in the database and subsequently rendering it within the Document Object Model (DOM) of other users' sessions.\nThe root cause is located in the application's handling of user-controllable input fields where the server-side logic fails to implement robust output encoding or content security policies (CSP) sufficient to prevent script injection. When a malicious actor submits crafted input containing JavaScript payloads—such as <script> tags or event handler attributes like 'onload' or 'onerror'—the application persists this payload without modification. Consequently, the payload is retrieved and served to the browser of any user accessing the affected page or component.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector (such as a profile field, project description, or task comment) that is rendered unsanitized in the application UI. Second, the attacker submits a malicious script payload that bypasses basic filters. Third, the Tuleap server stores the payload in the underlying database. Finally, when a victim navigates to the view containing the stored script, the browser parses the malicious code as legitimate content. The execution occurs within the security origin of the Tuleap application, granting the script access to the victim’s session-specific data.\nFrom a post-exploitation perspective, the impact is severe. Since the script executes within the victim's session, the attacker can leverage the victim’s existing authentication headers and cookies. This facilitates unauthorized actions, such as modifying project settings, deleting trackers, or escalating privileges if the victim is a Tuleap administrator. Furthermore, the attacker can perform arbitrary DOM manipulation to trick users into revealing credentials or redirecting them to malicious domains. The persistence of the vulnerability ensures that the payload remains active until it is manually removed from the database or the application's sanitization logic is corrected."
}