BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-10-30

Assigner: GitHub, Inc.

Description

Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-28

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-28

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62368

Affected Vendors & Products

Vendor	Product	Version / Range
taiga	taiga	6.8.3
taiga	taiga	6.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Taiga, an open source project management platform, exists in versions 6.8.3 and earlier. It is a remote code execution vulnerability caused by unsafe deserialization of untrusted data in the Taiga API. This means that an attacker could potentially execute arbitrary code on the server by sending specially crafted data to the API. The issue is fixed in version 6.9.0.

Impact Analysis

The vulnerability allows remote code execution, which means an attacker could gain control over the affected system, potentially leading to full compromise. This can result in unauthorized access, data theft, data modification, service disruption, or further attacks within the network.

Mitigation Strategies

Upgrade Taiga to version 6.9.0 or later, as this version contains the fix for the remote code execution vulnerability caused by unsafe deserialization of untrusted data.

Hi! I’m here to help you understand CVE-2025-62368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70