CVE-2025-47292

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-47292

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47292.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-47292

Aliases

GHSA-hf7r-rjh4-5fc8

Published

2025-05-14T10:44:28.478Z

Modified

2026-04-02T12:54:21.220041Z

Severity

9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

Cap Collectif vulnerable to insecure deserialization leading to remote code execution

Details

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the DebateAlternateArgumentsResolver deserializes a Cursor, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47292.json",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/cap-collectif/cap-collectif

Affected ranges

Type: GIT
Repo: https://github.com/cap-collectif/cap-collectif
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

812f2a7d271b76deab1175bdaf2be0b8102dd198

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47292.json"