A stored cross-site scripting flaw in Tuleap Enterprise Edition allows an attacker to embed malicious script code into data that is permanently saved by the application. When a user views the stored content, the inserted script executes in the victim’s browser, giving the attacker behavior that runs with the privileges of the victim’s session. The CVE description explicitly notes that arbitrary script execution in a user’s browser session can occur.

Dassault Systèmes’ Tuleap Enterprise Edition versions 17.0 through 17.5 are affected. The vulnerability does not apply to any later releases, and older editions are not impacted.

The high CVSS score of 8.7 places the vulnerability in the high‑severity range. EPSS information is not available, but the lack of a KEV listing does not preclude exploitation. Attackers can introduce the malicious code by submitting specially crafted content that is stored within the system; this requires an authenticated user who has write privileges to the vulnerable data field. Once the content is rendered to any user, the stored attack vector becomes active. Because the flaw is stored, a user or attacker with access to the input mechanisms can create the payload, making the risk tangible for systems that allow widespread content editing.