CVE-2025-27156: Tuleap allows content injection via emails sent by the mass emailing features
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tuleap Community Editionto a version that resolves this vulnerability.Fixed in 16.4.99.1740567344 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.4-6 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.3-11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27156?
The severity of CVE-2025-27156 is currently classified as moderate due to potential phishing risks.
How do I fix CVE-2025-27156?
To fix CVE-2025-27156, upgrade your Tuleap installation to the latest version that addresses the HTML email content sanitization.
What versions of Tuleap are affected by CVE-2025-27156?
CVE-2025-27156 affects Tuleap Community Edition versions up to 16.4.99 and specific versions of Tuleap Enterprise Edition.
Can CVE-2025-27156 lead to data breaches?
Yes, CVE-2025-27156 can facilitate phishing attempts which could potentially lead to data breaches if exploited.
Who is responsible for resolving CVE-2025-27156?
It is the responsibility of the system administrators using Tuleap to apply the necessary updates to resolve CVE-2025-27156.