CVE-2026-105408: Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
Published Oct 12, 2026
·Updated
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
Affected Software
1 affected component
Tuleap Tuleap Enterprise Edition>=17.0<=17.5
Event History
Oct 12, 2026
CVE Published
via MITRE·10:44 AM
Data Sourced
via MITRE·10:44 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Tuleap Enterprise Edition versions 17.0 through 17.5 are affected.
2
What access does an attacker need to exploit this issue?
The severity vector indicates network-reachable exploitation with low privileges required and user interaction required. An attacker would need a low-privileged account and would need a user to interact with the stored malicious content.
3
What could exploitation allow?
Successful exploitation could allow arbitrary script code to execute in a user's browser session. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.