Titra
CVE-2025-69288
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Titra Admin
-
DeliveryEdit timeEntryRule global setting with malicious JS
-
ExploitValue passed unsanitized to NodeVM
-
ExecutionSandbox escape executes code on host
-
ImpactFull RCE (potentially as root)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires an authenticated account with Admin privileges in Titra prior to version 0.99.49 (PR:H). The specific prerequisite is write access to the global 'timeEntryRule' setting, whose string value is passed unsanitized into a NodeVM sandbox and executed as JavaScript. The limiting factor is the admin authentication requirement - a non-admin or unauthenticated attacker cannot reach the vulnerable setting. Impact is worsened in default Docker deployments where, prior to the fix, the process ran as root. No user interaction beyond the admin's own action is needed. |
| Impact | The vendor CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a full-triad remote code execution, but the single most important mitigating signal is PR:H - exploitation requires an already-authenticated Admin account, per both the description ('any authenticated Admin user') and the vector. This is therefore an admin-to-host escalation (breaking out of the NodeVM sandbox to run OS-level code) rather than an unauthenticated internet-facing RCE, which materially lowers real-world risk. POC/exploit detail is publicly available via the GitHub Security Advisory (GHSA-pqgx-6wg3-gmvr), so publicly available exploit information exists, but this is NOT confirmed active exploitation - the CVE is not in CISA KEV. No EPSS score or SSVC decision data was provided. The commit confirms the root cause: the timeEntryRule global setting was passed to a NodeVM for execution without sanitization; the fix adds validateSandboxCode() denylist screening and, notably, a Dockerfile change to drop from root to USER node - implying pre-patch code execution could occur as root, raising impact severity where the default container was used. Net: a genuine high-severity RCE but gated behind admin trust, so it is a priority for Titra operators to patch yet not a mass-exploitation candidate. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted Titra Admin credentials edits the global 'timeEntryRule' setting, injecting JavaScript that escapes the NodeVM sandbox (e.g., via constructor/prototype chain or module access) to execute arbitrary code on the server host. Because pre-patch containers ran as root, the payload could run with full privileges. Exploit details are publicly documented in the GitHub Security Advisory, lowering the effort to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Remote code execution in Titra time-tracking software prior to version 0.99.49 allows an authenticated Admin user to inject arbitrary JavaScript through the global 'timeEntryRule' setting, which is passed unsanitized into a NodeVM sandbox and executed on the server. Because the weakness sits behind the admin login boundary (CVSS vector PR:H), a non-admin or unauthenticated attacker cannot reach the vulnerable setting, but any holder of an Admin account achieves full confidentiality, integrity, and availability impact across the host - worsened in default Docker deployments where the process historically ran as root. Publicly available exploit code exists and the vendor has released a fix in 0.99.49, so this should be treated as a high-priority patch for internet-exposed instances with multiple administrators.
RemediationAI
Upgrade Titra to version 0.99.49 or later (vendor-released patch); the fix commit is https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e and the tagged release is at https://github.com/kromitgmbh/titra/releases/tag/0.99.49, with full details in advisory GHSA-pqgx-6wg3-gmvr. For environments that cannot patch immediately, the most effective compensating control is to tightly restrict who holds the Admin role, since exploitation is gated entirely on PR:H and requires the ability to write the 'timeEntryRule' global setting - audit admin accounts, remove stale or shared administrators, and disable public self-registration or any path that could grant admin. Additionally, redeploy the container to run as a non-root user (the patched Dockerfile does this via chown/USER node); running as root turns a successful injection into a host-level compromise, whereas a non-root process confines blast radius, though it does not by itself prevent the injected code from running inside the application context. If the timeEntryRule feature is not actively used, removing or emptying that setting removes the injection vector altogether at the cost of disabling custom time-entry logic. Because publicly available exploit code exists for the pre-fix pattern, combine the upgrade with a review of admin activity logs and any outbound network connections from the Titra host for signs of post-exploitation, and avoid exposing the administrative interface directly to the internet while remediation is in progress.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Titra is a Meteor/Node.js application, and its time-entry business rules are configured through a global setting named 'timeEntryRule'. Versions before 0.99.49 accepted that string from the admin UI and passed it directly into a NodeVM sandbox for execution as live JavaScript. The root cause is CWE-20 (Improper Input Validation): the application never constrained the content of the setting before handing it to a code-execution engine, so the value could escape the intended rule logic and reach Node.js internals. The commit making the fix is telling - it introduces a validateSandboxCode() helper in imports/utils/vm_sandbox.js that rejects dangerous patterns (process, global, require of fs/child_process/vm/repl, eval, new Function, constructor chains, __proto__, Buffer, __dirname/__filename, module/require introspection, plus unicode/hex obfuscation of eval), enforces a 50KB length cap, and re-parses the code for valid syntax before execution; it also wires the validator into the updateGlobalSettings Meteor method for the timeEntryRule field. Critically, the same commit alters the Dockerfile to add 'RUN chown -R node:node /app' and 'USER node', removing the former root context that magnified post-exploitation impact. The blacklist-plus-syntax-check approach is defense-in-depth rather than a hard sandbox boundary, which is why version parity matters rather than relying on the pattern list alone.
Know when Titra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Admin authentication needed so PR:H; network-reachable web setting with no added complexity (AV:N/AC:L); NodeVM sandbox escape to host OS justifies S:C and full C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
Executive ViewAI
Titra time-tracking software versions prior to 0.99.49 contain a critical remote code execution flaw that allows an authenticated administrator to execute arbitrary code on the server, potentially compromising the entire host and all data it holds. Publicly available exploit code exists, and organizations running internet-exposed Titra instances with multiple administrators face risk of full system takeover, data theft, and operational disruption, especially in default Docker deployments where the process historically runs as root. Leadership should prioritize patching because a single compromised admin credential can lead to complete loss of confidentiality, integrity, and availability across affected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. Rated critical severity (CVSS 10.0), this
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. Rated critical severity (CVSS 9.8), th
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated h
Unauthorized access control in Titra versions 0.99.49 and earlier enables authenticated users to view and modify time en
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. Rated medium severity (CVSS 5
Titra time tracking software versions 0.99.49 and below contain a mass assignment vulnerability in their API that allows
titra 0.99.52 leaks sensitive global configuration settings to any authenticated user via an unprotected Meteor DDP publ
Exploit-DB