CVE-2025-27156: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.24%

15.2th percentile

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
enalean	tuleap	< 16.3-11	16.3-11
enalean	tuleap	< 16.4.99.1740567344	16.4.99.1740567344
enalean	tuleap	>= 16.4 < 16.4-6	16.4-6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.