CVE-2026-105408

Executive Summary

CVE-2026-105408 is a stored cross-site scripting (XSS) vulnerability in Tuleap Enterprise Edition affecting versions 17.0 through 17.5. An authenticated attacker with low privileges can inject persistent script code that executes in the browser session of any user who views the affected content. Successful exploitation allows session hijacking, credential theft, and arbitrary actions performed in the victim's authenticated context, with high confidentiality and integrity impact across trust boundaries.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically the stored (persistent) variant. The NVD description states that Tuleap Enterprise Edition versions 17.0 through 17.5 are affected and that the flaw "could allow an attacker to execute arbitrary script code in user's browser session."

Per the CVSS v3.1 vector, the attack is network-reachable (AV:N), requires low privileges (PR:L), and requires user interaction (UI:R) — consistent with an authenticated low-privilege user storing a malicious payload that a higher-privileged or peer user later views. The scope is changed (S:C), meaning the executed script can affect resources beyond the vulnerable component's security authority — a typical characteristic of XSS where the script runs in the victim's origin and can act on behalf of that user.

The root mechanism is failure to neutralize user-supplied input before it is stored and subsequently rendered in a web page. When an application persists attacker-controllable data (for example, in a stored field, comment, or object attribute) without context-aware output encoding, that data is later served to other users and interpreted by the browser as executable markup or script rather than inert text. The precise injection point, storage field, and render context are not disclosed in the available NVD/CNA data, so no specific parameter, endpoint, or file path can be confirmed. Organizations should treat the vulnerable surface as any Tuleap EE input field that accepts user content and is later displayed to other users.

Impact scoring: confidentiality and integrity are both rated High (C:H/I:H) because an attacker can read data available to the victim's session and perform state-changing actions as that victim. Availability is rated None (A:N), as the flaw does not directly degrade service availability.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-105408; the following attack chain is inferred from the vulnerability class (stored XSS) and the CVSS profile. No specific function names, endpoints, or parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Tuleap Enterprise Edition instance and confirms the version falls within 17.0–17.5. Access is footprinted via product banners and login interfaces. A Shodan search for product:"Tuleap" or http.title:"Tuleap" identifies candidate hosts.

2. Access acquisition. Because the CVSS vector requires low privileges (PR:L), the attacker must hold a valid account — obtained through legitimate provisioning, self-registration if enabled, compromised credentials, or phishing. This is an authenticated, delayed-execution attack, not pre-auth.

3. Payload storage (trigger). The attacker submits input containing malicious client-side script into a persistent field that the application stores without adequate output encoding. The exact field is undisclosed; the vulnerability class indicates the payload is written to backend storage and later served to other users without neutralization for the output context.

4. Victim execution (user interaction). A targeted user — potentially with elevated privileges — visits the page, document, or view where the stored content is rendered. The browser parses the injected content as script and executes it within the origin of the affected Tuleap instance (UI:R, S:C). No public PoC exists; the precise triggering render path is inferred from the XSS class.

5. Post-exploitation impact. The executing script runs in the victim's authenticated browser session, enabling theft of session tokens or other session data, execution of authenticated requests on the victim's behalf, and manipulation of page content shown to the victim. With C:H/I:H, this can lead to account takeover, privilege escalation within Tuleap, and onward access to projects, artifacts, and sensitive data the victim can reach. Persistent storage means the payload can affect multiple users over time until removed.

Impact Assessment

Business impact is significant for any organization relying on Tuleap Enterprise Edition 17.0–17.5 as a project and application lifecycle management platform. Because Tuleap typically holds source code references, requirements, test artifacts, and internal project communications, a stored XSS that achieves session compromise can expose confidential product data and allow tampering with project records.

• Confidentiality (High): attacker-controlled script reads data available to the victim's session, including any secrets, tokens, or content rendered in the victim's context.
• Integrity (High): the attacker can act as the victim, modifying content and performing authenticated operations.
• Availability (None): no direct loss of service availability is indicated.
• Scope (Changed): the script executes with the trust of the vulnerable application's origin, affecting resources beyond the vulnerable component.
• Blast radius: every user who views the poisoned content is a potential victim; the stored payload persists until the malicious content is located and removed. Higher-privileged users viewing the content amplify impact.

Detection Guidance

The following rules are detection heuristics for the vulnerability class (stored XSS in a Tuleap instance). Field names and parameter names are not supplied by the advisory; rules should be tuned to the organization's actual Tuleap deployment and log formats. No CVE-specific signature is publicly available.

Sigma Rule

title: Potential Stored XSS Payload Submission in Tuleap
id: 7b1f5e02-9c4a-4d3e-a1b2-6f0c2d9e8a41
status: experimental
description: Detects HTTP requests containing script-like payloads consistent with stored XSS attempts against Tuleap EE 17.0-17.5.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105408
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1059.007
  - attack.t1189
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<svg/onload'
      - '%3Cscript'
  condition: selection_method and selection_payload
falsepositives:
  - Security testing of authorized users
  - Documentation containing code samples
level: medium

YARA Rule

rule CVE_2026_105408_Tuleap_Stored_XSS
{
    meta:
        description = "Detects HTML/HTTP content containing stored XSS-style payloads targeting Tuleap EE 17.0-17.5"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105408"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "document.cookie" nocase
        $t1 = "Tuleap" nocase
    condition:
        $t1 and 2 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105408 Possible Stored XSS Payload to Tuleap"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Tuleap"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"document.cookie"; nocase; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105408; classtype:web-application-attack; sid:2026105408; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      url.path != null and
      stringContains(http.request.body, "<script") ]
  [ network where http.request.method in ("GET", "POST") and
      url.path != null and
      stringContains(http.response.body, "<script") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval payload=urldecode(uri_query . " " . form_data)
| where match(payload, "(?i)(<script|javascript:|onerror=|onload=|%3Cscript)")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths
        by src_ip, cs_username
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,tuleap,">
  <rule id="2026105" level="10">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <regex type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=|%3Cscript)</regex>
    <description>CVE-2026-105408: Possible stored XSS payload submitted to Tuleap EE</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_105408,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version is documented in the available data.

1. Immediate mitigations (compensating controls, since no patch exists):

   • Restrict network exposure of Tuleap EE instances; place behind VPN or authenticated reverse proxy — do not expose management or project views to the public internet.
   • Enforce least privilege: limit which accounts can post content that is rendered to other users; minimize the number of high-privileged users who view user-generated content.
   • Deploy WAF rules matching script-like payloads (see detection rules above) in blocking mode for input fields.
   • Apply a Content-Security-Policy with restrictive script-src (no unsafe-inline) where the Tuleap UI permits it, to reduce script execution impact.
   • Set session cookies with HttpOnly and Secure attributes to limit token theft via document.cookie.
   • Audit existing stored content for injected script; identify and remove poisoned records.

2. Patch / upgrade steps: Monitor the Tuleap vendor security advisories and release notes for a fixed version covering 17.0–17.5. Because none is documented here, no fixed version can be recommended. Until a patch ships, treat the deployment as vulnerable and rely on the mitigations above.

3. Long-term hardening:

   • Enforce context-aware output encoding and input validation in application code per CWE-79 remediation guidance.
   • Adopt a coordinated vulnerability disclosure and patch-tracking process; subscribe to Tuleap security announcements.
   • Maintain an asset inventory of Tuleap deployments and version pinning to detect drift into vulnerable ranges.
   • Conduct periodic security testing of user-generated content rendering paths.

References

• NVD — CVE-2026-105408: https://nvd.nist.gov/vuln/detail/CVE-2026-105408
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Tuleap security advisories (vendor): https://www.tuleap.org/ (monitor official release/security announcements for a fix covering 17.0–17.5)
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CISA KEV Catalog (verify current status; CVE-2026-105408 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign or exploit-in-the-wild evidence is documented for this CVE. No public PoC, exploit code, or Nuclei template is currently available.