CVE-2025-62368
Published: 28 October 2025
Summary
CVE-2025-62368 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Taiga is an open source project management platform that contains a remote code execution vulnerability in its API in versions 6.8.3 and earlier. The flaw stems from unsafe deserialization of untrusted data, tracked as CWE-502, and carries a CVSS 3.1 score of 9.0 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity Availability under changed scope.
An attacker with limited privileges can supply crafted serialized data to the API, triggering arbitrary code execution on the server. The vector requires some user interaction and authenticated access but enables full compromise of the affected component once triggered.
The vulnerability is addressed in version 6.9.0. The GitHub Security Advisory GHSA-cpcf-9276-fwc5 recommends upgrading to the fixed release to eliminate the unsafe deserialization path.
EPSS for this CVE reached a peak of 0.7078 with a current value of 0.6408, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36562
Vulnerability details
Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical remote code execution (RCE) in a public-facing web API (Taiga project management platform) via unsafe deserialization, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this deserialization vulnerability by mandating upgrade to Taiga version 6.9.0 or later.
SI-10 enforces validation of untrusted information inputs to the Taiga API, preventing exploitation via unsafe deserialization of malicious data.
AC-6 enforces least privilege for authenticated users accessing the vulnerable Taiga API, limiting the attack surface as recommended in the security advisory.