Is CVE-2025-27401 actively exploited?

No active exploitation of CVE-2025-27401 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-27401 be exploited remotely?

Yes. CVE-2025-27401 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-27401?

CVE-2025-27401 has a CVSS score of 4.6 (MEDIUM).

HOME VULNERABILITIESCVE-2025-27401

MEDIUM

CVE-2025-27401

CWE-440Published: March 4, 2025· Updated: Jun 17, 2026

4.6

CVSS v3.1

Official Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

NVD Source

Technical Analysis

CVE-2025-27401 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.