CVE-2025-55288: Kreaweb Genealogy XSS Vulnerability

CVE-2025-55288 Overview

CVE-2025-55288 is an authenticated reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Kreaweb Genealogy application, a family tree PHP application maintained by MGeurts. Versions prior to 4.4.0 fail to properly encode user-controlled input rendered in toast notifications. An authenticated attacker can inject JavaScript that executes in another user's browser session. Successful exploitation enables session hijacking, data theft, and user interface manipulation. The maintainer released a fix in version 4.4.0.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim user's session, enabling session takeover and theft of family tree data.

Affected Products

Kreaweb Genealogy versions prior to 4.4.0
PHP application component app/Http/Controllers/Back/TeamController.php
PHP application component app/Livewire/Backups/Manage.php

Discovery Timeline

2025-08-18 - CVE-2025-55288 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55288

Vulnerability Analysis

The vulnerability resides in the way Genealogy renders dynamic values inside Livewire toast notifications. User-controlled strings, such as team owner names and backup file names, are concatenated directly into notification messages without HTML entity encoding. When another authenticated user views the resulting notification, the browser parses the injected markup and executes attacker-supplied JavaScript.

Because the payload runs inside the victim's authenticated session, an attacker can read Document Object Model (DOM) content, exfiltrate session cookies, submit requests on behalf of the victim, and manipulate rendered pages. The scope changes to a different security context, allowing the payload to affect the victim rather than only the attacker.

Root Cause

The root cause is missing output encoding on values passed to the $this->toast()->success() helper. The affected code paths concatenated $newOwner->name and $backup_to_delete directly into notification strings. Laravel's Blade templates auto-escape output, but these controller and Livewire code paths bypass templating and construct raw strings, so the e() helper must be applied explicitly.

Attack Vector

Exploitation requires an authenticated account with permission to trigger the affected workflows, such as transferring team ownership or managing backup files. The attacker stores an XSS payload in a controllable field, then induces a privileged user to view the resulting toast notification. User interaction is required on the victim side.

php

// Patch in app/Http/Controllers/Back/TeamController.php
// Notify the new owner synchronously
$newOwner->notify(new OwnershipTransferred($team));

- $this->toast()->success(__('team.transfer'), __('team.transferred_to') . $newOwner->name . '.')->flash()->send();
+ $this->toast()->success(__('team.transfer'), __('team.transferred_to') . e($newOwner->name) . '.')->flash()->send();

// Patch in app/Livewire/Backups/Manage.php
if ($disk->exists(config('backup.backup.name') . '/' . $backup_to_delete)) {
    $disk->delete(config('backup.backup.name') . '/' . $backup_to_delete);

-   $this->toast()->success(__('backup.backup'), $backup_to_delete . ' ' . __('backup.deleted'))->expandable(false)->flash()->send();
+   $this->toast()->success(__('backup.backup'), e($backup_to_delete) . ' ' . __('backup.deleted'))->expandable(false)->flash()->send();
}

Source: GitHub commit 1683b3c. The fix wraps user-controlled values in Laravel's e() helper, which converts characters such as <, >, and " to HTML entities.

Detection Methods for CVE-2025-55288

Indicators of Compromise

Team member or user profile fields containing HTML tags, <script> markup, or on* event handler attributes.
Backup file names that contain angle brackets, quotes, or JavaScript URI schemes.
Application logs showing toast notifications rendered with unescaped payloads following team ownership transfers or backup deletions.

Detection Strategies

Perform static review of Livewire components and controllers for calls to toast() that concatenate model attributes without the e() helper.
Inspect HTTP responses for reflected input inside <div> notification containers where entity encoding is absent.
Correlate authenticated user activity that modifies team names or backup file names with subsequent DOM-based script execution alerts from browser telemetry.

Monitoring Recommendations

Enable a strict Content Security Policy (CSP) and alert on Content-Security-Policy-Report-Only violations from inline script execution.
Monitor for anomalous session activity such as unexpected privilege changes or data exports following the viewing of team management pages.
Review web application firewall (WAF) logs for HTML and JavaScript payloads submitted to team and backup management endpoints.

How to Mitigate CVE-2025-55288

Immediate Actions Required

Upgrade Kreaweb Genealogy to version 4.4.0 or later, which applies HTML entity encoding to affected notification messages.
Audit user-controlled fields such as team names and stored backup file names for previously injected payloads and sanitize or remove offending entries.
Rotate session cookies and force reauthentication for administrative users if exploitation is suspected.

Patch Information

The maintainer fixed the vulnerability in commit 1683b3c by wrapping user-controlled values in the e() helper before concatenating them into toast notifications. Full details are available in the GitHub Security Advisory GHSA-3h8x-g9xj-rhwg and the upstream patch commit.

Workarounds

Restrict team management and backup administration privileges to a minimal set of trusted accounts until the upgrade is applied.
Deploy a WAF rule that blocks HTML control characters in team name and backup file name parameters.
Enforce a Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS payloads.

bash

# Update via Composer to the fixed release
composer require mgeurts/genealogy:^4.4.0
php artisan config:clear
php artisan view:clear