CVE-2025-69288

CVE-2025-69288 is a remote code execution vulnerability in Titra, an open source project time tracking software. In versions prior to 0.99.49, the application allows any authenticated Admin user to modify the timeEntryRule value directly in the database. This value is subsequently passed to a NodeVM context for execution as code without proper sanitization, enabling arbitrary code execution. The vulnerability is associated with CWE-20 (Improper Input Validation) and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

An attacker with authenticated Admin privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting a malicious timeEntryRule payload and updating it in the database, the attacker triggers execution within the NodeVM sandbox, achieving full remote code execution on the server. The changed scope (S:C) amplifies the impact, granting high confidentiality, integrity, and availability effects, potentially allowing server compromise.

Mitigation is addressed in Titra version 0.99.49, which fixes the issue by implementing proper sanitization or validation of the timeEntryRule before NodeVM execution. Security practitioners should upgrade to this version immediately. Relevant resources include the fixing commit at https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065e, the release page at https://github.com/kromitgmbh/titra/releases/tag/0.99.49, and the GitHub security advisory at https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvr.