Titra has Remote Code Execution in Admin Functionality
Priority HIGH 74CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00851 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed titra (kromitgmbh): 0.99.49
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kromitgmbh | titra | before 0.99.49 | 0.99.49 | Patch available | CNA |
- titra Vendorkromitgmbh Affected before 0.99.49 Fixed in 0.99.49 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:* | before 0.99.49 | Vulnerable | kromitgmbh |
- cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:* Versions before 0.99.49 Vulnerable ·kromitgmbh
Remediation
- Fix · CNA titra (kromitgmbh) Fixed in 0.99.49
Timeline
- 2026-10-02 Threatist record created from CVE-2025-69288
References
More kromitgmbh Titra vulnerabilities
- TI-2026-17477 Titra APIs have Improper Access Control CVSS 3.1HIGH 8.1
- TI-2026-17478 Titra API Contains Mass Assignment Vulnerability CVSS 3.1MEDIUM 4.3
- TI-2022-02397 Improper Authorization in kromitgmbh/titra CVSS 3.1CRITICAL 10.0
- TI-2022-01941 Weak Password Requirements in kromitgmbh/titra CVSS 3.1CRITICAL 9.8
- TI-2022-01879 Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra CVSS 3.1HIGH 8.0
- TI-2022-01881 Cross-site Scripting (XSS) - DOM in kromitgmbh/titra CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences