{"id":"CVE-2026-105407","published":"2026-10-12T11:17:09.673","lastModified":"2026-10-15T19:17:15.693","description":"An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.3ds.com/trust-center/security/security-advisories/cve-2026-105407","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Tuleap Enterprise Edition is vulnerable to OS command injection in versions 17.0 through 17.5, allowing authenticated attackers to execute arbitrary commands on the server with high impact. This vulnerability enables remote code execution and complete system compromise.","exploitability":"Exploitation requires an authenticated user account with sufficient privileges, but is relatively straightforward once access is obtained since the vulnerability allows direct command injection without complex payload crafting.","blast_radius":"If exploited, this vulnerability could lead to full server compromise, data exfiltration, and persistence mechanisms being established across the Tuleap platform, affecting all users and projects within the system.","remediation":"Upgrade to Tuleap Enterprise Edition 17.6 or later to remediate this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","web","enterprise"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:52:37.742Z"}}