CVE-2025-48076: Galette Membership Application XSS Flaw

CVE-2025-48076 Overview

CVE-2025-48076 is a stored Cross-Site Scripting (XSS) vulnerability in Galette, an open-source membership management web application for non-profit organizations. Versions 1.1.5.2 and earlier allow an authenticated user to edit a group name and inject an XSS payload that executes when other users view the affected group. The issue is fixed in version 1.2.0. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and [CWE-87] (Improper Neutralization of Alternate XSS Syntax).

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads into group names, executing arbitrary script in the browsers of administrators and members who view the affected group.

Affected Products

• Galette versions 1.1.5.2 and below
• Galette 1.2.0-alpha (pre-release)
• Fixed in Galette 1.2.0

Discovery Timeline

• 2025-11-04 - CVE-2025-48076 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48076

Vulnerability Analysis

The vulnerability is a stored XSS flaw located in the group management functionality of Galette. When a user with permission to edit groups submits a group name, the application persists the raw input without sufficient sanitization or output encoding. When the group name is later rendered in the web interface, the browser interprets embedded HTML and JavaScript as executable content.

Because the payload is stored server-side, it fires for every user who loads a page displaying the group. This includes administrators, giving attackers a path to session theft, action forgery on behalf of privileged users, and potential account takeover within the Galette instance.

Root Cause

The root cause is improper neutralization of user-supplied input in the group name field. The application fails to encode HTML metacharacters (<, >, ", ') or strip script constructs before storing and re-rendering the value. [CWE-87] indicates that alternate encoding forms of XSS syntax are also not filtered, meaning obfuscated payloads may bypass any partial defenses that exist.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit groups. The attacker submits a crafted group name containing an XSS payload through the group editing form. When any other user, including administrators, browses to a page that lists or displays that group, the injected script executes in their session context. User interaction is required, consistent with the CVSS 4.0 vector value UI:P. Refer to the Galette GitHub Security Advisory GHSA-ccwq-mxx3-chvh for additional technical context.

Detection Methods for CVE-2025-48076

Indicators of Compromise

• Group name records containing HTML tags such as <script>, <img, <svg, or event handler attributes like onerror= and onload=.
• Database entries in the Galette groups table with unusually long values or non-printable characters.
• Unexpected outbound HTTP requests from administrator browsers to external domains after accessing the groups interface.

Detection Strategies

• Query the Galette database for group names matching regular expressions targeting HTML tag syntax and JavaScript URI schemes.
• Review web server access logs for POST requests to group edit endpoints that contain URL-encoded angle brackets or javascript: schemes.
• Inspect browser Content Security Policy (CSP) violation reports for inline script executions originating from Galette pages.

Monitoring Recommendations

• Enable and monitor web application firewall (WAF) rules for XSS payloads targeting Galette group management endpoints.
• Audit accounts with group-editing privileges and review recent modifications to group entities.
• Log and alert on administrator session cookies being transmitted to unexpected destinations.

How to Mitigate CVE-2025-48076

Immediate Actions Required

• Upgrade all Galette instances to version 1.2.0 or later without delay.
• Audit existing group names for injected HTML or JavaScript and sanitize any suspect entries.
• Rotate administrator credentials and invalidate active sessions if malicious group names are found.

Patch Information

The issue is fixed in Galette version 1.2.0. The vendor advisory is published as GHSA-ccwq-mxx3-chvh on GitHub. Administrators should follow the standard Galette upgrade procedure and verify database schema migrations complete successfully before returning the application to production.

Workarounds

• Restrict group-edit permissions to a minimal set of trusted administrator accounts until the patch is applied.
• Deploy a Content Security Policy (CSP) header that blocks inline script execution to reduce impact if injection occurs.
• Place Galette behind a WAF configured with rulesets that block common XSS payload patterns in POST bodies.

# Example CSP header to mitigate inline XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"