This vulnerability (CWE-78) affects Tuleap Enterprise Edition from Dassault Systèmes, specifically versions >=17.3-1 <=17.3-12 and >=17.5-1 <=17.5-28. It involves improper neutralization of special elements in OS commands, enabling an attacker with low privileges to execute arbitrary OS commands on the server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to full compromise of the affected server, including unauthorized command execution, potentially resulting in data theft, system manipulation, or denial of service. The attacker requires only low privileges and no user interaction, increasing the risk of exploitation.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected versions and monitor for suspicious activity related to command execution.