Dassault Systèmes Tuleap Enterprise Edition: Stored cross-site scripting

Summary

A stored cross-site scripting (XSS) vulnerability in Tuleap Enterprise Edition from 17.0 through 17.5 allows an attacker to inject script code that is executed in the browser session of users who view the affected content. The attacker needs an account on the platform, and a user must interact with the malicious content. The CNA rates the issue as CVSS 8.7 (High) with a changed scope, but a third-party source lists a much lower score of 3.5, so the severity is disputed.

Affected

• Tuleap Enterprise Edition 17.0 through 17.5 according to the vendor advisory.
• Machine-readable CNA data lists 17.0-1 to 17.0-41 and 17.5-1 to 17.5-32; the exact affected builds between 17.1 and 17.4 are unclear.

Fixed in

Unknown. A secondary aggregator states an upgrade to version 17.6 or later, but this is unconfirmed and must be checked against the vendor advisory.

Workaround

Unknown. No vendor workaround was found. Limit who can create or submit content that other users view until a fix is applied.

Exploitation

• Not known to be exploited in the wild; not listed in the CISA KEV catalog.
• No public proof of concept found in the research.
• EPSS 0.00203 (very low predicted exploitation probability).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Check whether any Tuleap Enterprise Edition 17.0 or 17.5 instance (including builds in between) is in use and whether it is reachable from the internet or by external partners.
• Open the 3DS advisory, confirm the fixed build and apply the vendor update as a priority for exposed instances.
• Until patched, restrict who can post content that other users view and monitor the NVD record and the 3DS advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• 3DS vendor advisory listing www.3ds.com
• CNA record mirror (Vulners) vulners.com
• OpenCVE CVE record app.opencve.io
• Strix CVE record (CNA ranges and CVSS) www.strix.ai
• VulDB score conflict vuldb.com
• HOL exploitation status hol.org
• Vulners EPSS vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:00.