CERT-FR: Multiple Redmine Vulnerabilities Identified

Published March 17th, 2026

Detected March 17th, 2026

Summary

CERT-FR has issued a security advisory regarding multiple vulnerabilities discovered in Redmine software. The vulnerabilities include Cross-Site Scripting (XSS) and security policy bypass, affecting specific versions of Redmine. Users are advised to consult the Redmine security advisories for patch information.

View original document View source feed page

What changed

CERT-FR has published a security advisory (CERTFR-2026-AVI-0306) detailing multiple vulnerabilities found in Redmine software. The identified risks include security policy bypass, remote code injection (XSS), and other unspecified security issues. Affected versions are Redmine 6.0.x prior to 6.0.9, 6.1.x prior to 6.1.2, and all versions prior to 5.1.12.

Organizations using the affected Redmine versions must consult the official Redmine security advisories and apply the necessary patches to mitigate these risks. Failure to do so could lead to security breaches, including unauthorized code execution and policy circumvention. The advisory directs users to the Redmine security advisories page for detailed information on obtaining and applying the fixes.

What to do next

Review Redmine version and identify if affected by vulnerabilities listed in CERTFR-2026-AVI-0306.
Consult Redmine security advisories for available patches.
Apply necessary patches to affected Redmine installations.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 17 mars 2026 N° CERTFR-2026-AVI-0306 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Redmine

Gestion du document

Risques

Contournement de la politique de sécurité
Injection de code indirecte à distance (XSS)
Non spécifié par l'éditeur

Systèmes affectés

Redmine versions 6.0.x antérieures à 6.0.9
Redmine versions 6.1.x antérieures à 6.1.2
Redmine versions antérieures à 5.1.12

Résumé

De multiples vulnérabilités ont été découvertes dans Redmine. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.