CVE-2026-105412: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability (CVE-2026-105412) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') affecting Tuleap Enterprise Edition. It impacts versions from 17.5-1 up to and including 17.5-35. The flaw could allow an attacker with low privileges to read sensitive data from the Tuleap database. The CVSS 3.1 base score is 7.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, indicating network attack vector, low attack complexity, requires privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with limited privileges can exploit this SQL Injection vulnerability to gain unauthorized read access to the Tuleap database, potentially exposing sensitive information. There is no indication of integrity or full system compromise, but confidentiality is significantly impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Dassault Systèmes advisories for updates. Until a fix is available, restrict access to vulnerable versions and limit privileges to reduce exposure.