CVE-2017-7411: Tuleap PHP Object Injection via REST API Preference Value

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with low-privilege network access, no user interaction, and public exploit material, though not confirmed in KEV or tied to ransomware.

What it is

Tuleap 9.6 and earlier passes a user-controllable preference value from the REST API into unserialize() inside User::getRecentElements(), allowing second-order PHP object injection. Because attacker-supplied serialized objects are instantiated in application scope, gadget chains can be triggered to execute arbitrary code.

Impact

An authenticated attacker can inject arbitrary PHP objects and, depending on available gadget chains, achieve remote code execution, leading to full compromise of the Tuleap server and its data.

Attack surface

Reached over the network through the Tuleap REST API by a user who can set preference values; the CVSS vector indicates low privileges are required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.666, 99.25th percentile) and public references include an Exploit tag and an Exploit-DB entry, indicating public exploit material exists.

What to do

• Upgrade Tuleap to a version later than 9.6 that removes the unsafe unserialize() call in User::getRecentElements().
• If immediate upgrade is not possible, restrict or disable REST API access for untrusted or low-privilege accounts.
• Replace or wrap unserialize() with safe deserialization (e.g., allowed_classes restrictions) in any custom or patched code.
• Audit user preference storage and API endpoints that accept serialized data for similar injection paths.
• Monitor and limit outbound network activity from the Tuleap host to reduce post-exploitation impact.

Detection

• Search Tuleap and web server logs for REST API requests containing serialized PHP object strings (e.g., 'O:' patterns) in preference parameters.
• Alert on unexpected child processes spawned by the web/PHP process, which may indicate RCE via gadget chains.
• Monitor for anomalous file writes or outbound connections originating from the Tuleap server.
• Review application logs for errors or stack traces referencing unserialize() in User::getRecentElements().

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.