CVE-2025-69288

critical · 9.1

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

9.1

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2025-12-31

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
kromit	titra	< 0.99.49

Check a specific version with /api/v1/cve/match.

References

https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e
https://github.com/kromitgmbh/titra/releases/tag/0.99.49
https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr
https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-69288