CVE-2026-84285 PUBLISHED

OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

Assigner: 3DS
Reserved: 01.09.2026 Published: 21.09.2026 Updated: 21.09.2026

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Dassault Systèmes
Product	Tuleap Enterprise Edition
Versions	Default: unaffected affected from 17.3-1 to 17.3-12 (incl.) affected from 17.5-1 to 17.5-28 (incl.)

References

https://www.3ds.com/trust-center/security/security-advisories/cve-2026-84285

Problem Types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE