Critical severity · published Dec 31, 2025
CVE-2025-69288
Titra has Remote Code Execution in Admin Functionality
9.1
CVSS
0.9%
EPSS
No
On KEV
Description
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
titra · kromitgmbh
< 0.99.49 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69288
Patch
https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e
Release Notes
https://github.com/kromitgmbh/titra/releases/tag/0.99.49
Exploit
https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr
More from titra
8.1
CVE-2026-21694
Titra APIs have Improper Access Control
4.3
CVE-2026-21695
Titra API Contains Mass Assignment Vulnerability