Tuleap versions 9.6 and below suffer from a second order PHP object injection vulnerability. Continue reading...