CVE-2022-44637: Redmine

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.

Affected products

• Redmine Redmine: before 4.2.9 (fixed in 4.2.9); from 5.0.0, before 5.0.4 (fixed in 5.0.4)

Published 2022-12-12. Last modified 2026-06-17.