CVE-2026-105410: Tuleap Enterprise Edition XSS Vulnerability

CVE-2026-105410 Overview

CVE-2026-105410 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Tuleap Enterprise Edition versions 17.0 through 17.5. An authenticated attacker can inject persistent script payloads that execute in the browser session of any user who views the affected content. Successful exploitation allows an attacker to run arbitrary JavaScript in the victim's authenticated context, enabling session theft, forced actions, and content manipulation. The scope is marked changed in the CVSS vector, reflecting the ability to affect resources beyond the vulnerable component. The vulnerability was published to the National Vulnerability Database (NVD) on October 12, 2026.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in other users' browser sessions, including those of higher-privileged accounts, leading to account takeover and project data compromise.

Affected Products

Tuleap Enterprise Edition 17.0
Tuleap Enterprise Edition versions 17.1 through 17.4
Tuleap Enterprise Edition 17.5

Discovery Timeline

2026-10-12 - CVE-2026-105410 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-105410

Vulnerability Analysis

The flaw is a stored XSS condition in Tuleap Enterprise Edition, an application lifecycle management platform used for issue tracking, source control, and project collaboration. User-supplied input is persisted by the server and later rendered in another user's browser without adequate output encoding or sanitization. When a victim loads the affected view, the attacker-controlled payload executes within the origin of the Tuleap instance.

Because the vulnerable component runs in a shared, multi-tenant collaboration context, the stored payload reaches any user who browses the affected resource. Attackers can harvest session cookies, invoke privileged API endpoints on the user's behalf, pivot to project artifacts, or deliver secondary payloads that abuse the browser trust relationship with the Tuleap application.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. A field or content area accepts HTML or JavaScript markup, stores it, and renders it back to users without contextual output encoding. The vendor advisory published by Dassault Systèmes (3DS) documents the specific affected components and the fixed release.

Attack Vector

Exploitation requires network access to the Tuleap instance and low-privileged authentication to submit the malicious content. A victim must then interact with the affected view, satisfying the user interaction requirement in the CVSS vector. No code example is published by the vendor; refer to the 3DS Security Advisory CVE-2026-105410 for technical details on affected input fields and remediation.

Detection Methods for CVE-2026-105410

Indicators of Compromise

Tuleap content fields or trackers containing <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload=.
Outbound HTTP requests from user browsers to attacker-controlled domains originating from the Tuleap origin.
Unexpected session token access, API calls, or privilege changes performed from legitimate user sessions.

Detection Strategies

Review Tuleap application logs for POST and PUT requests containing HTML or JavaScript metacharacters in free-form fields.
Deploy Content Security Policy (CSP) reporting to surface inline script execution and blocked payloads tied to specific Tuleap pages.
Correlate web proxy or Secure Web Gateway logs for anomalous outbound requests referred from the Tuleap hostname.

Monitoring Recommendations

Alert on administrative or project-owner actions that occur immediately after a user views a tracker, wiki, or comment thread.
Monitor for mass retrieval of personal access tokens, SSH keys, or Git credentials through the Tuleap API.
Track Tuleap version strings across the estate to confirm all instances are on a fixed release.

How to Mitigate CVE-2026-105410

Immediate Actions Required

Upgrade Tuleap Enterprise Edition to the fixed release identified in the 3DS Security Advisory CVE-2026-105410.
Audit recently created or modified content in trackers, wikis, forums, and comments across projects on versions 17.0 through 17.5.
Rotate session tokens, personal access tokens, and API keys for any user whose session may have rendered untrusted content.

Patch Information

Dassault Systèmes has published vendor guidance for CVE-2026-105410. Administrators should consult the 3DS Security Advisory CVE-2026-105410 for the fixed version and upgrade instructions applicable to Tuleap Enterprise Edition 17.0 through 17.5.

Workarounds

Restrict content submission permissions to trusted users until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to the Tuleap origin.
Place the Tuleap application behind a Web Application Firewall (WAF) with rules that block common XSS payloads in request bodies.

bash

# Example restrictive CSP header for a reverse proxy fronting Tuleap
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;