by Kastro
Paper/Archive/CVE-2025-69288

CVE-2025-69288

kromitgmbh titra — Titra has Remote Code Execution in Admin Functionality

EPSS 0.9%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.2.582 × 2011.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Affected

ProductAffectedFixed inSource
titra< 0.99.49–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvrrefgithub.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065erefgithub.com/kromitgmbh/titra/releases/tag/0.99.49