An OS Command Injection flaw is present in Tuleap Enterprise Edition versions 17.0 through 17.5. The weakness allows an attacker to inject operating system commands into inputs processed by the application, leading to arbitrary command execution on the server. The vulnerability stems from improper sanitization of user‑supplied data in the affected code paths, as categorized by CWE‑78, and can compromise the confidentiality, integrity, and availability of the host system if exploited.

The flaw affects Dassault Systèmes’ Tuleap Enterprise Edition, specifically releases from 17.0 to 17.5. No specific subcomponents or modules are listed, so any installation of the affected product version is potentially vulnerable and should be reviewed.

The CVSS score of 8.8 classifies the problem as high severity, indicating significant exploitability. The EPSS score is 2%, and this vulnerability is not listed in CISA’s KEV catalog, so the current exploit prevalence is unknown. Based on the description, the likely attack vector is through the web interface where untrusted input is processed, though the exact module path is not disclosed. If successful, an attacker could gain full control of the underlying operating system, read sensitive data, tamper with files, or disrupt services.