CVE-2026-105407: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability (CVE-2026-105407) is classified as CWE-78, indicating improper neutralization of special elements used in an OS command, leading to OS Command Injection. It affects Tuleap Enterprise Edition versions >=17.0-1 <=17.0-40 and >=17.5-1 <=17.5-31. An attacker with low privileges can exploit this flaw to execute arbitrary commands on the server, potentially compromising confidentiality, integrity, and availability. The CVSS v3.1 score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with limited privileges to execute arbitrary OS commands on the server hosting Tuleap Enterprise Edition. This can lead to full system compromise, data theft, or disruption of service. The high CVSS score (8.8) indicates significant risk to confidentiality, integrity, and availability of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory from Dassault Systèmes for current remediation guidance. Until a fix is available, restrict access to affected versions and monitor for suspicious activity related to command execution.