{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-64497",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-64497",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-12-08T22:28:49.215Z",
    "updatedAt": "2025-12-09T16:04:48.900Z",
    "importedAt": "2026-10-24T01:57:44.935Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Tuleap exposes releases for all projects to File Release System project administrators",
      "summary": "Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of  Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.",
      "affected": [
        {
          "vendor": "Enalean",
          "product": "tuleap",
          "versions": [
            {
              "version": "Tuleap Community Edition < 17.0.99.1762431347",
              "status": "affected"
            },
            {
              "version": "Tuleap Enterprise Edition < 17.0-2",
              "status": "affected"
            },
            {
              "version": "Tuleap Enterprise Edition < 16.13-7",
              "status": "affected"
            },
            {
              "version": "Tuleap Enterprise Edition < 16.12-10",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}