CVE-2026-105409

{
  "etk_id": "ETK-2026-1348",
  "cve_id": "CVE-2026-105409",
  "display_id": "CVE-2026-105409",
  "ghsa_id": "GHSA-mgmq-xp88-7qm6",
  "euvd_id": "EUVD-2026-97328",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Tuleap Enterprise Edition",
  "summary": "Tuleap Enterprise Edition 17.0 through 17.5 is affected by a stored cross-site scripting vulnerability. An attacker may be able to cause script to run in another user's browser session when that user views affected stored content. The evidence does not establish whether the attacker must be authenticated.",
  "mitigation": "Restrict untrusted users' ability to submit or modify content and limit access to affected Tuleap instances until an update is available. Apply the vendor's security update when released; no fixed version is recorded in the advisory.",
  "vendor": "Dassault Systèmes",
  "product": "Tuleap Enterprise Edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.0-1, <= 17.0-41",
        ">= 17.5-1, <= 17.5-32"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Tuleap Enterprise Edition",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.097,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.611376583333334,
  "t0_at": "2026-10-12T10:45:01.159000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T10:45:01.159000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T10:45:01.159000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105409"
    }
  }
}