medium
advisory
Redmine: Multiple security vulnerabilities
Multiple vulnerabilities in Redmine allow remote attackers to perform cross-site scripting (XSS), bypass security policies, or trigger denial-of-service conditions.
Triage facts
Revision 1- Applicability
- Redmine (< 6.0.12, 6.1.x < 6.1.6, 7.0.x < 7.0.3)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 2, 15:34 UTC
- Source quality
- A1Likely
Multiple vulnerabilities have been identified in Redmine that may permit remote exploitation. These issues include cross-site scripting (XSS), security policy bypasses, and denial-of-service (DoS) conditions. The CERT-FR advisory references security patches issued by the Redmine project on November 2, 2026.
Recommendation
- Upgrade Redmine to version 6.0.12, 6.1.6, 7.0.3, or later as specified in the official Redmine security advisories.
- Review the Redmine security advisories page for specific patching instructions and version compatibility.
Mitigations
Upgrade Redmine to version 6.0.12, 6.1.6, or 7.0.3
immediate
IT Operations
Multiple Redmine vulnerabilities