CVE-2025-64760: CSRF in Tuleap Tracker Triggers

Successful exploitation of CVE-2025-64760 allows an attacker to craft malicious requests that, when triggered by a legitimate user, can result in the creation or deletion of tracker triggers within Tuleap. Tracker triggers are automated actions that occur when specific events happen within the system, such as sending notifications or updating fields. An attacker could leverage this to disrupt workflows, exfiltrate sensitive data (if triggers are configured to expose it), or even gain unauthorized access to other parts of the Tuleap system depending on trigger configurations. The blast radius is directly tied to the privileges associated with the affected tracker triggers and the data they interact with.

1. Reserved2025-11-10
2. Published2025-12-08
3. Modified2025-12-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64760 is to upgrade to a patched version of Tuleap. Upgrade Tuleap Community Edition to version 17.0.99.1763126988 or Tuleap Enterprise Edition to version 17.0-3 or 16.13-8. If a direct upgrade is not feasible due to compatibility issues, consider rolling back to a previous, known-good version of Tuleap before the vulnerability was introduced. While a direct fix is preferred, implementing strict Content Security Policy (CSP) headers can help mitigate CSRF attacks by restricting the sources from which scripts can be executed. Monitor Tuleap logs for suspicious activity, particularly requests originating from unexpected sources or with unusual parameters. There are no specific Sigma/YARA rules available for this particular vulnerability at this time.