Tuleap Enterprise Edition: OS command injection
Summary
Tuleap Enterprise Edition versions in the 17.0 and 17.5 lines contain an OS command injection flaw (CWE-78). An authenticated attacker with low privileges could execute arbitrary operating system commands on the server, which the vendor rates with full impact on confidentiality, integrity and availability (CVSS 8.8). The vendor's CVE record lists narrower affected builds than the advisory, so the exact exposure must be confirmed with the vendor.
Affected
- Tuleap Enterprise Edition 17.0 through 17.5 (advisory wording)
- CVE record: 17.0-1 to 17.0-40 and 17.5-1 to 17.5-31
- Default configuration: unaffected according to the CVE record
Fixed in
Unknown. No fixed build was found; check the remediation section of the 3DS advisory.
Workaround
No vendor-confirmed workaround known.
- Restrict network access to the Tuleap instance.
- Limit account creation and reduce accounts with write privileges until a fix is applied.
- Run the Tuleap service under a dedicated, least-privileged account.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV. EPSS 1.8%.
- No public proof of concept or in-the-wild exploitation found in a limited search.
Our recommendation
- Confirm the installed 17.x build and compare it with the affected ranges.
- Obtain the fixed version from the 3DS advisory and apply it as soon as available.
- Until patched, restrict network access and review user accounts, including accounts created by XML import (see CVE-2026-19851).
- Monitor the 3DS advisory and public exploit sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- 3DS Security Advisory CVE-2026-105407 www.3ds.com
- OpenCVE CVE-2026-105407 app.opencve.io
- Vulners CVE-2026-105407 vulners.com
- VulDB 416877 vuldb.com
- Strix CVE-2026-105407 www.strix.ai
- SentinelOne CVE-2026-84285 www.sentinelone.com
- SentinelOne CVE-2026-19851 www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:31.
Original description (NVD)
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.