CVE-2026-105409: Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
Published Oct 12, 2026
·Updated
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
Affected Software
1 affected component
Tuleap Enterprise Edition>=17.0<=17.5
Event History
Oct 12, 2026
CVE Published
via MITRE·10:45 AM
Data Sourced
via MITRE·10:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Tuleap Enterprise Edition versions 17.0 through 17.5 are affected.
2
What access does an attacker need to exploit this issue?
The attacker needs low-level privileges and must cause a user to interact with the stored malicious content. Exploitation can be performed over the network.
3
What is the likely impact if exploitation succeeds?
An attacker could execute arbitrary script code in the affected user's browser session. The supplied severity vector indicates potential high confidentiality and integrity impact, with scope changed.