CVE-2026-105410: Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
Published Oct 12, 2026
·Updated
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
Affected Software
1 affected component
Tuleap Tuleap Enterprise Edition>=17.0<=17.5
Event History
Oct 12, 2026
CVE Published
via MITRE·10:45 AM
Data Sourced
via MITRE·10:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Tuleap Enterprise Edition versions 17.0 through 17.5 are affected.
2
What access does an attacker need to exploit this issue?
The severity vector indicates that an attacker needs network access, low privileges, and user interaction. Exploitation can result in arbitrary script execution in another user's browser session.
3
What is the potential impact if exploitation succeeds?
The vulnerability has high confidentiality and integrity impact and can affect a different security scope. The provided vector indicates no availability impact.