Vulnerability · Published May 14, 2025 · Assigned by GitHub_M

CVE-2025-47292Cap Collectif vulnerable to insecure deserialization leading to remote code execution

Critical 9.5

In plain English

A critical-severity unsafe deserialization in cap-collectif from cap-collectif. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)0.7%top 45.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternateArgumentsResolver` deserializes a `Cursor`, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.

Affected products (as reported)

Vendor	Product	Versions
cap-collectif	cap-collectif	< 812f2a7d271b76deab1175bdaf2be0b8102dd198

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/cap-collectif/cap-collectif/security/advisories/GHSA-hf7r-rjh4-5fc8 x_refsource_CONFIRM
https://github.com/cap-collectif/cap-collectif/commit/812f2a7d271b76deab1175bdaf2be0b8102dd198 x_refsource_MISC