Tuleap missing CSRF protections in the File Release System

4.6 CVSS

Vulnerability Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file release system. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1762267347, Tuleap Enterprise Edition 17.0-1, Tuleap Enterprise Edition 16.13-6, and Tuleap Enterprise Edition 16.12-9 fix the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64482

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →

CVE-2025-65962

Tuleap has missing CSRF protections its in tracker field dependencies

Medium 4.6

CVE-2025-64760

Tuleap has missing CSRF protections in its tracker trigger management system

Medium 4.6

CVE-2025-64499

Tuleap is missing CSRF protections for its planning management API

Medium 4.6

CVE-2025-64498

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Medium 4.6

CVE-2025-64497

Tuleap exposes releases for all projects to File Release System project administrators

Medium 6.5

Affected Vendor

Enalean

View all reports →

Affected Software

tuleap

Vulnerable Versions:

Tuleap Community Edition < 16.13.99.1762267347, Tuleap Enterprise Edition < 17.0-1, Tuleap Enterprise Edition < 16.13-6, Tuleap Enterprise Edition < 16.12-9