CVE-2025-48884

CVE-2025-48884 · Galette is vulnerable to XSS through Document Type

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.

CVSS 5.3 · Medium · EPSS 0.2%

Published: 2025-11-04T20:44:29.193Z
Updated: 2025-11-04T21:03:39.940Z

Stack: system

Affected products and versions

galette
Versions
- < 1.2.0: Affected
No fix published
galette Ubuntu:16.04:LTS
Versions
- 0.8+dfsg-1
- 0.8+dfsg-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

https://github.com/galette/galette/security/advisories/GHSA-3rc3-rc5x-vmr4
https://nvd.nist.gov/vuln/detail/CVE-2025-48884

Check your server →

CVE-2025-48884 · Galette is vulnerable to XSS through Document Type

Affected products and versions

galette

galette Ubuntu:16.04:LTS

Original sources