CVE-2025-48884
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
Risk Assessment
An attacker could execute arbitrary JavaScript in the user's browser, potentially leading to session or data theft. The risk affects Galette users.
Recommendation
Update Galette to version 1.2.0 or later.
Other vulnerabilities in Galette
See all- CVE-2025-58053Critical
Galette is a membership management web application for non-profit organizations. Prior to version 1.2.0, while updating any existing account with a self-forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
- CVE-2025-53922Medium
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
- CVE-2025-48076Medium
Galette versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
Original NVD description (English source)
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS