CVE-2025-64117: CSRF in Tuleap Enterprise Edition

An attacker can exploit this CSRF vulnerability to gain unauthorized control over SVN repositories managed by Tuleap. By crafting malicious requests and tricking authenticated users into executing them, an attacker could modify commit rules, potentially allowing unauthorized code changes or bypassing security controls. They could also alter immutable tags, disrupting version control and potentially leading to data corruption or loss. The impact is particularly severe in environments where SVN is used for critical software development or deployment pipelines, as a successful attack could compromise the integrity of the entire codebase.

1. Reserved2025-10-27
2. Published2025-11-12
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64117 is to upgrade Tuleap to a patched version: 16.13.99.1761813675, 16.13-5, or 16.12-8. If an immediate upgrade is not feasible, consider implementing stricter access controls and input validation on SVN commit rule and immutable tag management interfaces. Implementing a Content Security Policy (CSP) with strict origin restrictions can also help mitigate CSRF attacks. Regularly review SVN commit logs for any suspicious activity. After upgrading, confirm the fix by attempting to trigger a CSRF request and verifying that it is blocked.