CVE-2025-64497

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64497
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64497.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64497
Aliases
  • GHSA-v6vm-6rxf-7p2v
Published
2025-12-08T22:28:49.215Z
Modified
2026-04-10T05:34:01.394421Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Tuleap exposes releases for all projects to File Release System project administrators
Details

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64497.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/enalean/tuleap

Affected ranges

Type
GIT
Repo
https://github.com/enalean/tuleap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
403eb69f4cfafe52254c8f9bdbe66e1fedadc254

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.12-10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "17.0.99.1762431347"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "16.13"
            },
            {
                "fixed": "16.13-7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "17.0"
            },
            {
                "fixed": "17.0-2"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64497.json"