CVE-2025-55287: Kreaweb Genealogy XSS Vulnerability

CVE-2025-55287 Overview

CVE-2025-55287 is an authenticated stored cross-site scripting (XSS) vulnerability in Kreaweb Genealogy, a PHP-based family tree application maintained by MGeurts. Versions prior to 4.4.0 fail to properly encode user-controlled values before rendering them inside toast notifications. Authenticated attackers can inject arbitrary JavaScript that executes in another user's browser session. Successful exploitation enables session hijacking, theft of application data, and manipulation of the rendered user interface. The issue is tracked under [CWE-79] and is resolved in Genealogy 4.4.0.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the sessions of other Genealogy users, enabling account takeover and data exfiltration.

Affected Products

Kreaweb Genealogy versions prior to 4.4.0
MGeurts/genealogy PHP application (Laravel/Livewire stack)
Deployments using the TeamController and Backups/Manage Livewire components

Discovery Timeline

2025-08-18 - CVE-2025-55287 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55287

Vulnerability Analysis

Genealogy is a Laravel application that uses Livewire components to render toast notifications after user-triggered actions. Two code paths pass user-controlled strings into toast messages without HTML encoding. The first is the team ownership transfer flow in app/Http/Controllers/Back/TeamController.php, which interpolates $newOwner->name directly into a success toast. The second is the backup deletion flow in app/Livewire/Backups/Manage.php, which interpolates the $backup_to_delete filename into the toast body. Because Livewire renders these messages as HTML, any embedded <script> payload executes in the recipient's browser context.

Root Cause

The root cause is missing output encoding of attacker-influenced strings before they are concatenated into HTML-rendered notification content. Neither $newOwner->name nor $backup_to_delete was passed through Laravel's e() escaping helper, violating the standard XSS defense pattern for Blade and Livewire output.

Attack Vector

Exploitation requires an authenticated account with the ability to control either a user profile name or a backup filename. An attacker sets a malicious payload (for example, a name containing a <script> tag) and waits for another user, typically an administrator, to trigger the associated action. When the target performs the ownership transfer or backup deletion, the payload executes in their session and can exfiltrate cookies, tokens, or other in-page data.

php

// Patched code from app/Http/Controllers/Back/TeamController.php
// Notify the new owner synchronously
$newOwner->notify(new OwnershipTransferred($team));

- $this->toast()->success(__('team.transfer'), __('team.transferred_to') . $newOwner->name . '.')->flash()->send();
+ $this->toast()->success(__('team.transfer'), __('team.transferred_to') . e($newOwner->name) . '.')->flash()->send();

Source: GitHub commit 1683b3c

php

// Patched code from app/Livewire/Backups/Manage.php
if ($disk->exists(config('backup.backup.name') . '/' . $backup_to_delete)) {
    $disk->delete(config('backup.backup.name') . '/' . $backup_to_delete);

-   $this->toast()->success(__('backup.backup'), $backup_to_delete . ' ' . __('backup.deleted'))->expandable(false)->flash()->send();
+   $this->toast()->success(__('backup.backup'), e($backup_to_delete) . ' ' . __('backup.deleted'))->expandable(false)->flash()->send();
} else {
    $this->toast()->error(__('backup.backup'), __('backup.not_found'))->flash()->send();
}

Source: GitHub commit 1683b3c

Both fixes wrap the tainted variable in Laravel's e() helper, which HTML-encodes special characters before rendering.

Detection Methods for CVE-2025-55287

Indicators of Compromise

User profile name fields containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload=.
Backup filenames in the backup storage disk containing angle brackets, quotes, or JavaScript keywords.
Unexpected outbound HTTP requests from administrator browsers immediately after triggering ownership transfers or backup deletions.
New or modified sessions and API tokens created shortly after an admin viewed a toast notification.

Detection Strategies

Audit the users table for name values that contain <, >, ", ', or script substrings.
Review Laravel application logs for TeamController::transferOwnership and Backups\Manage::delete invocations correlated with anomalous session activity.
Inspect the Genealogy Git history to confirm the deployed commit is at or beyond 1683b3c.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that blocks inline scripts and alert on CSP violation reports.
Forward web server and Laravel logs to a central SIEM and alert on administrative actions triggered from unusual IPs or user agents.
Monitor for creation of new privileged Genealogy accounts or role changes following any XSS-suspect activity.

How to Mitigate CVE-2025-55287

Immediate Actions Required

Upgrade Genealogy to version 4.4.0 or later, which contains commit 1683b3c.
Rotate session cookies, API tokens, and administrator credentials that may have been exposed via a triggered payload.
Review and sanitize existing user names and backup filenames stored in the database and backup disk.
Restrict registration and team-ownership transfer capabilities to trusted users until patching is complete.

Patch Information

The vendor released the fix in Genealogy 4.4.0. The patch is described in the GitHub Security Advisory GHSA-j457-9m86-6q5r and implemented in commit 1683b3c, which wraps user-controlled values with Laravel's e() escaping helper before they are rendered in toast notifications.

Workarounds

If immediate upgrade is not possible, apply the upstream patch manually to TeamController.php and Livewire/Backups/Manage.php and redeploy.
Deploy a strict CSP with script-src 'self' and no unsafe-inline to reduce the impact of injected scripts.
Enforce server-side validation that rejects HTML metacharacters in user profile names and backup filenames.
Limit which roles can perform team ownership transfers and backup management until the patch is applied.

bash

# Upgrade Genealogy to the patched release
git fetch --tags
git checkout 4.4.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan view:cache