Tuleap Enterprise Edition CVE-2026-105409

Requires an authenticated account with at least low privileges (PR:L) on the Tuleap Enterprise Edition instance to store the malicious payload into a persistent application field, and requires a second victim user to subsequently view the affected content (UI:R) for the script to execute. Exploitation is limited to deployed versions 17.0 through 17.5 and is gated by both the attacker's need for valid credentials and the dependence on victim interaction, which bounds realistic impact to users who browse the poisoned content.

This is a stored XSS flaw (CWE-79) in Tuleap Enterprise Edition 17.0-17.5, reported by the vendor 3DS (Dassault Systèmes). The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7 High) indicates network-reachable, low-complexity exploitation, but it requires an authenticated low-privilege account (PR:L) to plant the payload and a victim to view the affected content (UI:R); the scope change (S:C) reflects that injected script executes in another user's browser context. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The two authenticating/victim-interaction requirements meaningfully lower real-world urgency relative to the 8.7 headline: this is a credible privilege-escalation/session-compromise vector in multi-tenant ALM deployments but not a wormable, unauthenticated internet threat. No conflicting signals were detected - the CVSS vector is internally consistent with a stored XSS description; the main gap is the absence of EPSS/KEV/POC intelligence to gauge likelihood of weaponization.

A low-privileged but authenticated Tuleap user injects a malicious script into a persistent field (e.g., a tracker artifact, comment, or project content). When a higher-privileged user such as a project administrator later views that content, the stored script executes in their authenticated browser session, enabling session hijacking or actions performed as the victim. No public exploit code is identified in the provided data.