CVE-2026-105407

Summary

Tuleap Enterprise Edition is vulnerable to OS command injection in versions 17.0 through 17.5, allowing authenticated attackers to execute arbitrary commands on the server with high impact. This vulnerability enables remote code execution and complete system compromise.

Exploitability

Exploitation requires an authenticated user account with sufficient privileges, but is relatively straightforward once access is obtained since the vulnerability allows direct command injection without complex payload crafting.

Blast radius

If exploited, this vulnerability could lead to full server compromise, data exfiltration, and persistence mechanisms being established across the Tuleap platform, affecting all users and projects within the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Tuleap Enterprise Edition 17.6 or later to remediate this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.