Tuleap Enterprise Edition EUVD-2026-83901

Requires an authenticated low-privilege account on a Tuleap Enterprise Edition instance running an affected version (17.3 through 17.5), reachable over the network (PR:L, no user interaction). Exploitation targets a server-side feature that passes attacker-controlled input to an OS shell; the specific feature is not named in the advisory. Limiting factors: valid credentials are needed (mitigated where self-registration is disabled and account provisioning is tightly controlled), and only versions 17.3-17.5 are affected, so instances outside that range or with access restricted to trusted internal users face substantially reduced exposure.

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection yielding full compromise (C:H/I:H/A:H) of the server. The single meaningful barrier is PR:L - an attacker needs a valid low-privilege authenticated account, which for a self-hosted ALM/DevOps collaboration platform like Tuleap is often obtainable (self-registration, project members, contractors). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization at time of analysis - the risk is driven by the intrinsic severity of authenticated RCE rather than by observed in-the-wild activity. No conflicting signals between the vector and the description: both point to remote authenticated command execution. Key data gaps: the vendor advisory (3ds.com) is the sole reference and the description does not name the specific vulnerable feature/endpoint, so defenders cannot pinpoint which functionality to restrict - verify against the vendor advisory for the exact affected component and fixed version.

A low-privileged authenticated user of a Tuleap Enterprise Edition instance (17.3-17.5) submits crafted input to a feature that shells out to the operating system, injecting shell metacharacters that cause arbitrary commands to run under the Tuleap service account. This grants a foothold for full server compromise, lateral movement, and access to source code and CI/CD secrets. No public exploit code was identified in the provided data, and the exact injectable endpoint is not disclosed in the advisory description.