CVE-2025-48076

CVE-2025-48076 · Galette is vulnerable to Cross-site Scripting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.

CVSS 5.3 · Medium · EPSS 0.2%

Published: 2025-11-04T20:40:09.121Z
Updated: 2025-11-04T21:04:06.991Z

Stack: system

Affected products and versions

galette
Versions
- < 1.2.0: Affected
No fix published
galette Ubuntu:16.04:LTS
Versions
- 0.8+dfsg-1
- 0.8+dfsg-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

https://github.com/galette/galette/security/advisories/GHSA-ccwq-mxx3-chvh
https://nvd.nist.gov/vuln/detail/CVE-2025-48076

Check your server →

CVE-2025-48076 · Galette is vulnerable to Cross-site Scripting

Affected products and versions

galette

galette Ubuntu:16.04:LTS

Original sources