Executive brief
Decidim's private data exports can lead to data leaks
Affected products
- RubyGems decidim-core
- RubyGems decidim
Junglewise Threat Intelligence
CVE-2025-65017: Decidim's private data exports can lead to data leaks
CVE-2025-65017 · Severity: medium · CVSS 4 · Published 2026-02-03
Technologies: decidim (RubyGems). Vendors: RubyGems.
Related threats
- Decidim has a cross-site scripting vulnerability in the version control page
- Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
- Decidim vulnerable to data disclosure through the embed feature
- Cross-site scripting (XSS) in the dynamic file uploads
- Decidim vulnerable to sensitive data disclosure