CVE-2025-69288

CriticalCVSS 9.1

Published: 31/12/2025(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.83%

56th percentile - higher than 56% of all known CVEs

Summary

Titra is open source project time tracking software. Prior to version 0.99.49, any authenticated Admin user can modify the timeEntryRule in the database. The value is then passed to a NodeVM to execute as code. Without sanitization, it leads to Remote Code Execution. Version 0.99.49 fixes the issue.

Risk Assessment

An attacker with admin privileges can execute arbitrary code on the server, potentially leading to full system compromise and data breach.

Recommendation

Immediately upgrade Titra to version 0.99.49 or later and restrict admin panel access to trusted users only.

Other vulnerabilities in Titra

CVE-2026-42092Medium
In titra version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. No public patch is available at the time of publication.

Original NVD description (English source)

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS