TI-2025-38635 Aliases CVE-2025-62367

Taiga Blind SQL Injection Time Based

LOW 21CWE-89Published 2025-10-28 · Updated 2025-10-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injection allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00215 11th percentileScored 2026-11-07

Fix Fixed taiga-back (taigaio): 6.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
taigaio	taiga-back	before 6.9.0	6.9.0	Patch available	CNA

taiga-back Vendortaigaio Affected before 6.9.0 Fixed in 6.9.0 Patch available CNA

Remediation

Fix · CNA taiga-back (taigaio) Fixed in 6.9.0

Timeline

2026-10-02 Threatist record created from CVE-2025-62367

References

Other 1

https://github.com/taigaio/taiga-back/security/advisories/GHSA-chm9-9wwq-xffj

TI-2025-38636 Taiga Authenticated Remote Code Execution CVSS 3.1CRITICAL 9.1
TI-2026-29859 XSS in taiga-front CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences