Redmine Patches XSS and Bypass Flaws
Redmine fixed multiple vulnerabilities allowing remote XSS injection and security policy bypass; users should update to patched versions.
ANSSI (CERT-FR) issued an advisory summarizing multiple vulnerabilities disclosed by the Redmine project affecting versions prior to 6.0.11, 6.1.x before 6.1.4, and 7.x before 7.0.1. The flaws allow an attacker to perform indirect remote code injection (cross-site scripting) and to bypass security policy controls within the Redmine project management application.
No indication of active exploitation is provided in this advisory. Administrators running affected Redmine versions should consult the vendor's security advisory page and apply the available patches to remediate the identified issues. No CVE identifiers, indicators of compromise, or attribution details were included in the source bulletin.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1085
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free