Dassault Systèmes Tuleap Enterprise Edition: Stored Cross-Site Scripting
Summary
A stored Cross-Site Scripting (XSS) vulnerability in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an attacker to inject script code that is executed in the browser session of other users. The attacker needs a low-privilege account on the platform and a user must interact with the malicious content. The CVSS 3.1 base score from the CNA is 8.7 (High) with a changed scope and high confidentiality and integrity impact.
Affected
- Tuleap Enterprise Edition 17.0-1 to 17.0-41
- Tuleap Enterprise Edition 17.5-1 to 17.5-32
- Default configuration: unaffected according to the CNA record
Fixed in
Unknown. Check the Dassault Systèmes advisory or Tuleap release notes for the patched version (a sibling record indicates 17.6 or later, not confirmed for this CVE).
Workaround
- No vendor-published workaround identified.
- Restrict access to the Tuleap instance to VPN or internal networks.
- Limit the number of user accounts and review who holds them.
Exploitation
- Not known to be exploited in the wild; not listed in the CISA KEV catalogue according to aggregator sources.
- No public proof-of-concept exploit found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether Tuleap Enterprise Edition in versions 17.0 or 17.5 is in use and whether it is internet-facing.
- Upgrade to a fixed version as soon as the vendor confirms it, or apply the vendor patch.
- Until patched, restrict access to internal networks or VPN and remove unneeded accounts.
- Monitor the vendor advisory for updates, as the vulnerability type is listed inconsistently in sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- 3DS Security Advisory CVE-2026-105408 www.3ds.com
- OpenCVE CVE-2026-105408 app.opencve.io
- Vulners CVELIST CVE-2026-105408 vulners.com
- VulDB CVE-2026-105408 vuldb.com
- Strix CVE-2026-105408 www.strix.ai
- HOL Guard CVE-2026-105408 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:58.
Original description (NVD)
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.