CVE-2025-30203

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

4.8 Medium

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.31%Up 0.3 points since Apr 1, 2025

What each source reports

CVE List Score used 4.8

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

Record: CVE-2025-30203
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
Weakness: CWE-84, CWE-79
Updated: 2026-11-02

EUVDEUVD-2025-8850 4.8

Record: EUVD-2025-8850
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
Updated: 2026-11-02

NVD 4.8

Record: CVE-2025-30203
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79, CWE-84
Updated: 2026-11-02

OSV 4.8

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

Record: CVE-2025-30203
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
Weakness: CWE-79, CWE-84
Updated: 2026-11-02

Affected products

enalean tuleap

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30203 is a medium vulnerability (CVSS 4.8) in Enalean Tuleap, published March 31, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.