Tuleap Enterprise Edition EUVD-2026-97329

Exploitation requires an authenticated account on the Tuleap Enterprise Edition instance (version 17.0 through 17.5) with enough privilege to submit persistent content into a stored field that is later rendered to other users, matching PR:L. Because it is stored XSS, a second user must subsequently view the attacker-controlled content for the payload to fire, matching UI:R - the attacker cannot trigger execution unilaterally. The impact materializes in the viewing user's browser session (scope change), so the practical severity depends on which users can be lured into viewing attacker-controlled content and the privilege level of those victims. Limiting factors: valid authentication, victim interaction, and running an affected 17.0-17.5 version.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7 High) describes a network-reachable stored XSS requiring a low-privileged authenticated account and victim interaction, with a scope change reflecting that injected script executes in a different security context (the victim's authenticated browser session). This is internally consistent with a classic stored XSS (CWE-79). No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation likelihood cannot be quantified from the inputs and there is no public exploit identified at time of analysis. The only reference is the vendor's own advisory (3DS/Dassault Systèmes); there is no independent NVD or CISA corroboration in the provided data. Net assessment: this is a legitimately serious authenticated-attacker issue for organizations running the affected Tuleap Enterprise Edition versions, but the PR:L and UI:R requirements plus the absence of any exploitation-probability signals make it a patch-in-normal-cycle priority rather than an emergency, unless the deployment exposes low-trust user accounts to higher-privilege victims.

A low-privileged authenticated user stores a malicious script payload in a Tuleap field that is later rendered to other users (e.g., a tracker artifact, comment, or project content). When a higher-privileged user views that content, the script executes in their authenticated session, enabling session/token theft or actions performed as the victim. No public exploit code was identified in the provided data.