CVE-2025-64497

MEDIUM EPSS 14.9%
Published Dec 8, 20256mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Dec 8, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
14.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-639

Affected Products 4

VendorProductVersionRange
enaleantuleap* <16.12-10
enaleantuleap* <17.0.99.1762431347
enaleantuleap*≥16.13  –  <16.13-7
enaleantuleap*≥17.0  –  <17.0-2

References 4

  • github.com https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254
    Patch
  • github.com https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v
    Vendor Advisory
  • tuleap.net https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254
    Broken LinkPatch
  • tuleap.net https://tuleap.net/plugins/tracker/?aid=45583
    Issue TrackingVendor Advisory

Remediation

  • github.com https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254
    Patch
  • tuleap.net https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254
    Broken LinkPatch