Back to Database
Status published
High
CVE-2025-65017
Decidim's private data exports can lead to data leaks
Vulnerability Description
Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65017
Credits & Attribution
No credits recorded in the NVD database.
References
More from decidim
View All →CVE-2024-45594
Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds
High
7.7
CVE-2024-41673
Decidim has a cross-site scripting vulnerability in the version control page
High
7.1
CVE-2024-39910
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
Medium
5.4
CVE-2024-32469
Decidim has cross-site scripting (XSS) in the pagination
High
7.1
CVE-2024-32034
Cross-site scripting (XSS) in the decidim admin activity log
Medium
6.8
Affected Vendor
decidim
View all reports →Affected Software
decidim
Vulnerable Versions:
>= 0.30.0, < 0.30.4, >= 0.31.0.r1, < 0.31.0
Timeline
Official Publish:
February 3rd, 2026
Last Modified:
February 3rd, 2026
Added to House:
July 22nd, 2026