EN PT-BR
← Voltar ao feed
medium

CERT-FR Advisory: Multiple Redmine Vulnerabilities Allow XSS and Security Bypass

1 fonte(s) · 1 atualização(ões) · publicado 01/11/2026 21:00 · coletado há 1 hora

The French CERT-FR issued advisory CERTFR-2026-AVI-1434 covering multiple vulnerabilities in Redmine, the open-source project management tool. The flaws can be exploited to achieve indirect remote code injection (XSS), a security policy bypass, and a denial of service. Affected versions include Redmine 6.1.x prior to 6.1.6, 7.0.x prior to 7.0.3, and versions prior to 6.0.12. CERT-FR references Redmine's official security advisories bulletin published 02 November 2026.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1434 covers multiple vulnerabilities in Redmine, the open-source project management tool. Per the advisory, they allow indirect remote code injection (XSS), a security policy bypass and a denial of service. No CVE IDs, components, or attacker prerequisites (authentication, configuration, user interaction) are given. Affected versions are Redmine 6.1.x before 6.1.6, 7.0.x before 7.0.3 and all versions before 6.0.12; the fixed releases are 6.1.6, 7.0.3 and 6.0.12. Patches are listed in the vendor's security advisories page.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 2 November 2026, pointing to the Redmine security_advisories bulletin of the same date as the source for the fixes.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:19.

Detalhes técnicos

  • Impact: indirect remote XSS, security policy bypass, denial of service.
  • Affected products: Redmine 6.1.x < 6.1.6, 7.0.x < 7.0.3, < 6.0.12.
  • Source: Redmine security_advisories bulletin, 02 November 2026.

Remediação

  • Apply the patches referenced in Redmine's official security advisories.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Advisory: Multiple Redmine Vulnerabilities Allow XSS and Security Bypass

    ler a análise desta fonte

    The French CERT-FR issued advisory CERTFR-2026-AVI-1434 covering multiple vulnerabilities in Redmine, the open-source project management tool. The flaws can be exploited to achieve indirect remote code injection (XSS), a security policy bypass, and a denial of service. Affected versions include Redmine 6.1.x prior to 6.1.6, 7.0.x prior to 7.0.3, and versions prior to 6.0.12. CERT-FR references Redmine's official security advisories bulletin published 02 November 2026.

    Technical Details

    • Impact: indirect remote XSS, security policy bypass, denial of service.
    • Affected products: Redmine 6.1.x < 6.1.6, 7.0.x < 7.0.3, < 6.0.12.
    • Source: Redmine security_advisories bulletin, 02 November 2026.

    Remediation

    • Apply the patches referenced in Redmine's official security advisories.