CVE-2025-65017— Decidim's private data exports can lead to data leaks
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-65017
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Decidim's private data exports can lead to data leaks
Source: NVD (National Vulnerability Database)
Vulnerability Description
Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Decidim 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Decidim是Decidim开源的一个参与式民主框架，用 Ruby on Rails 编写。 Decidim 0.30.0版本至0.30.4之前版本和0.31.0.rc1版本至0.31.0之前版本存在安全漏洞，该漏洞源于私有数据导出功能存在UUID碰撞，可能导致数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-65017
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-65017
请登录查看更多情报信息。
- Release v0.30.4 · decidim/decidim · GitHubx_refsource_MISC
- Release v0.31.0 · decidim/decidim · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-65017
IV. Related Vulnerabilities
Same product: decidim
- CVE-2026-40869
Decidim amendments can be accepted or rejected by anyone - CVE-2026-40870
Decidim's comments API allows access to all commentable reso - CVE-2026-23891
Decidim has a Cross-site scripting (XSS) vulnerability via u - CVE-2024-45594
Decidim allows cross-site scripting (XSS) in the online or h - CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the vers
Same vendor: decidim
- CVE-2026-40869
Decidim amendments can be accepted or rejected by anyone - CVE-2026-40870
Decidim's comments API allows access to all commentable reso - CVE-2026-23891
Decidim has a Cross-site scripting (XSS) vulnerability via u - CVE-2024-45594
Decidim allows cross-site scripting (XSS) in the online or h - CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the vers
Same weakness: CWE-200
- CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter ma - CVE-2026-8198
Activity Logs, User Activity Tracking, Multisite Activity Lo - CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41520
Cillium exposes sensitive information included in the cilium - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro
V. Comments for CVE-2025-65017
No comments yet