CVE-2025-69288 Titra has Remote Code Execution in Admin Functionality
An authenticated admin can inject code via time entry rules, leading to remote code execution in Titra time tracking software.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-69288?
CVE-2025-69288 is a critical code injection vulnerability in kromitgmbh titra, published on 31 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
Weakness: CWE-20
Which versions are affected by CVE-2025-69288?
It affects 1 product.
Products include Kromit Titra.
How do I fix CVE-2025-69288?
No fix has been published for CVE-2025-69288 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-69288 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69288 exists.
Other vulnerabilities in kromitgmbh titra
- CVE-2022-2595 Improper Authorization in kromitgmbh/titra
- CVE-2022-2026 Cross-site Scripting (XSS) - Stored in kromitgmbh/titra
- CVE-2022-2028 Cross-site Scripting (XSS) - Generic in kromitgmbh/titra
- CVE-2022-2029 Cross-site Scripting (XSS) - DOM in kromitgmbh/titra
- CVE-2022-2027 Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra
Sources
Also known as GHSA-pqgx-6wg3-gmvr.