CVE-2026-105410: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability (CVE-2026-105410) affects Tuleap Enterprise Edition from Dassault Systèmes, specifically versions 17.0-1 up to 17.0-41 and 17.5-1 up to 17.5-32. It is a stored Cross-site Scripting (XSS) issue categorized under CWE-79, caused by improper neutralization of input during web page generation. Successful exploitation could allow an attacker to execute arbitrary script code in the context of the victim's browser session, potentially leading to session hijacking or other malicious actions. The CVSS v3.1 score is 8.7, reflecting network attack vector, low attack complexity, requiring low privileges and user interaction, with high impact on confidentiality and integrity, and no impact on availability.

An attacker exploiting this vulnerability can execute arbitrary scripts in the context of a victim's browser session, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the user. The vulnerability affects confidentiality and integrity but does not impact availability.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory from Dassault Systèmes for current remediation guidance. Until a fix is applied, users should exercise caution with untrusted input and consider applying any recommended workarounds from the vendor.