CVE-2014-8791: project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote a...

Security readout for executives and security teams

Tuleap versions before 7.7 can allow an authenticated remote user to abuse project registration and run PHP code on the server. The issue depends on the sys_create_project_in_one_step setting being disabled. No active exploitation is cited in the provided sources. Exposure is limited to Tuleap deployments before 7.7 where sys_create_project_in_one_step is disabled and attackers can authenticate. Public internet exposure increases concern, but the sources do not provide prevalence or asset-discovery data. Prioritize remediation for any internet-facing or broadly accessible Tuleap instance. Authenticated code execution can become a server compromise, but urgency should be balanced by confirming the specific configuration condition. Mitigation focus: Identify all Tuleap deployments and their exact versions.; Upgrade affected Tuleap instances to 7.7 or later.; Check whether sys_create_project_in_one_step is disabled on legacy instances..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.