CVE-2026-105409

Executive Summary

CVE-2026-105409 is a stored cross-site scripting (XSS) vulnerability affecting Tuleap Enterprise Edition versions 17.0 through 17.5. An authenticated attacker with low privileges can persist malicious script content that executes in the browser session of any user who views the affected page, potentially leading to session hijacking, credential theft, or actions performed on behalf of the victim. With a CVSS score of 8.7, the vulnerability is rated High severity due to its scope change and high confidentiality and integrity impact, though no public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored (persistent) variant of cross-site scripting. Tuleap Enterprise Edition is an application lifecycle management (ALM) and collaboration platform, and versions 17.0 through 17.5 are affected.

In a stored XSS scenario, the application accepts user-supplied input and stores it in a backend datastore (such as a database, comment field, project description, or similar persistent record). Because the application fails to properly sanitize or encode this input before rendering it back to other users, the injected script is served as part of the page content and executes within the security context of the victim's browser session whenever the affected content is viewed.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N describes the following characteristics:

• Attack Vector (Network): the vulnerability is exploitable remotely over the network.
• Attack Complexity (Low): no special conditions or race conditions are required.
• Privileges Required (Low): the attacker must hold a valid low-privileged account.
• User Interaction (Required): a victim must view the page or content containing the stored payload.
• Scope (Changed): the vulnerability can affect resources beyond the security scope of the vulnerable component, meaning script execution can impact the victim's session and potentially other trusted resources.
• Confidentiality (High): sensitive data such as session tokens or credentials may be exposed.
• Integrity (High): the attacker may modify data or perform actions as the victim.
• Availability (None): no direct denial-of-service impact.

The specific input vector, vulnerable parameter, or rendering context within Tuleap is not detailed in the available NVD description. No function names, class names, URL endpoints, or file paths are disclosed. Any such detail should not be assumed, as it is not derivable from the provided intelligence. The attack surface is the web-facing application interface where authenticated users submit content that is persisted and later rendered to other users.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (stored XSS) and the CVSS vector. No public proof-of-concept or exploit code is available; the following describes the vulnerability-class-level chain.

1. Reconnaissance / Target Identification: The attacker identifies an internet- or intranet-accessible Tuleap Enterprise Edition instance running a version between 17.0 and 17.5. Version detection may occur via banner or response fingerprinting. The attacker must be able to authenticate, since Privileges Required is Low, implying a valid low-privileged account is needed.

2. Triggering the Flaw: Using the authenticated low-privileged account, the attacker submits crafted input containing script content into a persistent field within the application (for example, a field that stores content later rendered to other users). The absence of proper output encoding causes the input to be stored without neutralization. The exact field or parameter is not specified in the available data and should be determined through application testing.

3. Payload / Execution Method: When a victim user (with User Interaction Required) views the page or content where the stored input is rendered, the browser executes the injected script in the context of the Tuleap application's origin. The payload executes under the victim's authenticated session.

4. Post-Exploitation Impact: Because Scope is Changed with High Confidentiality and High Integrity impact, the attacker can read sensitive data accessible to the victim (including session tokens that could enable session hijacking), and can perform actions or modify data as the victim. This may facilitate lateral movement within the Tuleap environment or escalation against connected systems, depending on what the victim's session can access. No public exploit code is available, and no specific payload pattern can be confirmed from the provided data.

Impact Assessment

The business impact of CVE-2026-105409 is significant for organizations relying on Tuleap Enterprise Edition for project management, source code collaboration, and software lifecycle workflows. Tuleap typically aggregates sensitive project data, user accounts, and potentially integration credentials for CI/CD and repository systems.

Key impact points:

• Confidentiality (High): Stored XSS allows the attacker to exfiltrate any data the victim's browser session can access, including page content, tokens, and potentially personal or project-specific information.
• Integrity (High): The attacker can act as the victim, modifying content, submitting changes, or altering configuration accessible to that user.
• Scope (Changed): Impact extends beyond the vulnerable component, meaning the attack may affect other resources or trust boundaries.
• Blast Radius: Any user who views the affected stored content is a potential victim. In a collaborative platform, a single injected payload can propagate to multiple users across teams, increasing the blast radius. The low privilege requirement lowers the barrier to entry for malicious insiders or compromised low-privilege accounts.
• Availability (None): No direct availability impact is expected.

The CVSS base score is 8.7 (High). EPSS has not yet been scored by FIRST.org, and CISA KEV does not list this CVE. No active exploitation in the wild has been reported.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Exploitation Attempt in Tuleap Enterprise Edition
id: 7f3c9a12-1b2e-4d5f-9a8c-2e6b0d4f1a77
status: experimental
description: Detects suspicious user input containing script tags or event handlers submitted to Tuleap web application, potentially indicating stored XSS injection attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105409
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_uri:
    cs-uri-stem|contains:
      - '/tuleap/'
      - '/plugins/'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<img'
      - '<svg'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate users posting code snippets or documentation containing HTML examples
level: medium
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_105409_Stored_XSS_Tuleap
{
    meta:
        description = "Detects stored XSS payload patterns associated with CVE-2026-105409 in Tuleap Enterprise Edition"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105409"
        cve = "CVE-2026-105409"

    strings:
        $script_tag = "<script" ascii nocase
        $js_proto = "javascript:" ascii nocase
        $event_onerror = "onerror=" ascii nocase
        $event_onload = "onload=" ascii nocase
        $event_onmouseover = "onmouseover=" ascii nocase
        $svg_tag = "<svg" ascii nocase
        $img_tag = "<img" ascii nocase

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105409 Tuleap Enterprise Edition Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"tuleap"; nocase; http.request_body; content:"<script"; nocase; sid:2026105409; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-105409, confidence Medium;)

alert http any any -> any any (msg:"CVE-2026-105409 Tuleap Stored XSS JavaScript Protocol Handler"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"tuleap"; nocase; http.request_body; content:"javascript:"; nocase; sid:2026105410; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-105409, confidence Medium;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST"
      and url.path : "*tuleap*"
      and http.request.body.text : ("*<script*" or "*javascript:*" or "*onerror=*" or "*onload=*") ]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| search method=POST uri_path="*tuleap*"
| eval payload=coalesce(form_data, request_body, uri_query)
| where match(payload, "(?i)(<script|javascript:|onerror=|onload=|<svg|<img)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,tuleap,">
  <rule id="2026105" level="10">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <match>tuleap</match>
    <regex type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=|&lt;svg|&lt;img)</regex>
    <description>CVE-2026-105409: Potential Stored XSS injection attempt against Tuleap Enterprise Edition</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_105409,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented for this CVE. The following guidance is class-level and should be validated against vendor advisories as they become available.

1. Immediate Mitigations:

   • Deploy a web application firewall (WAF) with rules to detect and block common XSS payload patterns (script tags, event handlers, javascript protocol) targeting the Tuleap application.
   • Enforce strict Content Security Policy (CSP) headers on Tuleap responses to limit script execution and reduce the impact of stored XSS. A policy that disallows inline and untrusted scripts is recommended.
   • Restrict creation of low-privileged accounts and review existing user permissions; ensure the principle of least privilege is applied.
   • Monitor web server logs for suspicious POST requests to Tuleap endpoints containing script content.
   • Educate users on phishing and untrusted content, though stored XSS can affect users regardless of awareness.

2. Patch / Upgrade Steps:

   • Monitor the vendor's advisory channels for a patched version. Since versions 17.0 through 17.5 are reported affected and no fixed version is specified, upgrading to the latest available release and applying all vendor updates is advised once a patch is published.
   • Subscribe to Tuleap security advisories to receive notification of a fix.

3. Long-Term Hardening:

   • Implement output encoding and input validation for all user-supplied content that is persisted and rendered.
   • Adopt a secure development lifecycle (SDLC) with regular security testing, including XSS-specific testing for stored data flows.
   • Deploy browser-level defenses such as CSP and HttpOnly/Secure cookie flags to limit session theft.
   • Conduct periodic penetration tests and code reviews focused on stored data rendering in collaborative platforms.

References

• NVD — CVE-2026-105409
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• OWASP — Cross Site Scripting (XSS)
• OWASP — Stored XSS Prevention Cheat Sheet
• Tuleap Official Website / Security Advisories

Threat actor campaigns: None identified. No exploit-in-the-wild evidence is available for CVE-2026-105409. No public PoC or exploit code has been observed.