CVE-2025-62368

CRITICAL

Taiga Authenticated Remote Code Execution

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-62368 has a selected CVSS score of 9.1 (critical); EIP currently links 1 catalogued exploit.

Description

Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

taiga-back

Browse taigaio / taiga-back
CVE List< 6.9.0affected

Proofs of concept

1

Catalogued exploits

MetasploitTaiga tribe_gig authenticated unserialize remote code executionMetasploit exploitby rootjog +1 moreExploit1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that exploits an authenticated PHP unserialization vulnerability (CVE-2025-62368) in Taiga by sending a crafted payload in the 'tribe_gig' parameter when creating a user story, leading to remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit authenticated RCE exploit for CVE-2025-62368. It authenticates, locates a project, and sends a base64-encoded Python deserialization payload via the 'tribe_gig' parameter to achieve code execution. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRuby
Target softwareTaiga
Attack typesDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that sends a crafted deserialization payload to achieve remote code execution. It includes a check method, payload generation, and command execution logic.

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:8modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:18-21modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:203-220

Requirements

  • Valid Taiga credentials (USERNAME, PASSWORD) are required.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:71-72
  • A project with kanban activated must exist for the authenticated user.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:110

Observed behavior

  • Authenticates to the Taiga API using supplied credentials.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:77-95
  • Retrieves a project with kanban activated for the authenticated user.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:97-114
  • Sends a base64-encoded Python deserialization payload in the 'tribe_gig' field of a user story creation request.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:145-157
  • Executes arbitrary commands on the target via the deserialization payload.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:186-201
  • Deletes the created user story as a cleanup step.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:135-143
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe module exploits CVE-2025-62368 by sending a crafted payload to the Taiga API endpoint /api/v1/userstories.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:18-22modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:145-157
Payload Generation
Payload withheldThe module generates a Python deserialization payload to execute arbitrary commands or Meterpreter sessions.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:169-170modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:214-217
Authentication
Payload withheldThe module is post-authentication; it logs in to the Taiga API before exploitation.modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:70-73modules/exploits/multi/http/taiga_tribe_gig_unserial.rb:77-95
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact was not executed; classification is based on static analysis of the provided text.
  • Review is limited to the provided module source code. Framework mixins (e.g., Msf::Exploit::CmdStager, Msf::Util::PythonDeserialization) and external payloads are not expanded or analyzed.
  • Binary files were not inspected; none were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

1