CVE-2025-27094

Public Exploit
Tuleap allows default values to be cleared from field configuration

Description

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute for the multiselectbox field, the default value, number of rows, and columns attributes for the text field, and the default value, size, and max characters attributes for the string field configurations are lost when added as criteria in a saved report. Additionally, in Tuleap Community Edition versions 16.4.99.1739806825 to 16.4.99.1739877910, this issue could be exploited to prevent access to tracker data by triggering a crash. This vulnerability has been fixed in Tuleap Community Edition 16.4.99.1739877910 and Tuleap Enterprise Edition 16.3-9 and 16.4-4.

Category

5.4
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.06%
Vendor Advisory github.com Vendor Advisory tuleap.net
Affected: Enalean tuleap
Published at:
Updated at:

References

Link Tags
https://github.com/Enalean/tuleap/security/advisories/GHSA-r85g-9wjx-pw7f vendor advisory patch
https://github.com/Enalean/tuleap/commit/ef650abb4a28359a3228d6e1102a742f7c013150 patch
https://tuleap.net/plugins/tracker/?aid=41849 vendor advisory issue tracking

Frequently Asked Questions

What is the severity of CVE-2025-27094?
CVE-2025-27094 has been scored as a medium severity vulnerability.
How to fix CVE-2025-27094?
To fix CVE-2025-27094, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-27094 being actively exploited in the wild?
It is possible that CVE-2025-27094 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-27094?
CVE-2025-27094 affects Enalean tuleap.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.