RubyGems/decidim-core CVE-2025-65017: medium 6.5, EPSS 0.31%

Decidim's private data exports can lead to data leaks

Action: Upgrade decidim-core to 0.30.4 or later.

bundle update decidim-core

Affected

Fixed versions

Sources

• osv: GHSA-3cx6-j9j4-54mp
• nvd: CVE-2025-65017
• https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp
• https://github.com/decidim/decidim/pull/13571
• https://github.com/decidim/decidim
• https://github.com/decidim/decidim/releases/tag/v0.30.4
• https://github.com/decidim/decidim/releases/tag/v0.31.0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2025-65017.yml

CVE-2025-65017 · published 2026-02-03T17:21:17Z · modified 2026-02-08T01:23:59.977284Z · JSON