CVE-2025-62368: Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe…

PriorityP263critical9CVSS 3.1

AVNACLPRLUIRSCCHIHAH

EXPLOIT

EPSS

1.41%

69.2th percentile

Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
taigaio	taiga-back	< 6.9.0	6.9.0

Detection & IOCsextracted from sources · hover to see the quote

versionTaiga <= 6.8.3↗

→Monitor for authenticated HTTP requests to the Taiga API endpoint that create user stories in a project, as the exploit abuses unserialization during this operation. ↗
→A public Metasploit module exists for this vulnerability (taiga_tribe_gig_unserial), indicating active exploit tooling is available; alert on its use or matching HTTP patterns against Taiga API endpoints. ↗

·Exploitation requires authentication; unauthenticated attackers cannot directly trigger the unsafe deserialization. ↗
·The vulnerability is fixed in version 6.9.0; instances running 6.8.3 or earlier remain vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.