Tuleap exposes releases for all projects to File Release System project administrators

6.5 CVSS

Vulnerability Description

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64497

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →

CVE-2025-65962

Tuleap has missing CSRF protections its in tracker field dependencies

Medium 4.6

CVE-2025-64760

Tuleap has missing CSRF protections in its tracker trigger management system

Medium 4.6

CVE-2025-64499

Tuleap is missing CSRF protections for its planning management API

Medium 4.6

CVE-2025-64498

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Medium 4.6

CVE-2025-64482

Tuleap missing CSRF protections in the File Release System

Medium 4.6

Affected Vendor

Enalean

View all reports →

Affected Software

tuleap

Vulnerable Versions:

Tuleap Community Edition < 17.0.99.1762431347, Tuleap Enterprise Edition < 17.0-2, Tuleap Enterprise Edition < 16.13-7, Tuleap Enterprise Edition < 16.12-10