{"action":"Upgrade ibexa/fieldtype-richtext to 4.6.25 or later.","affected":[{"fixed":"5.0.3","introduced":"5.0.0"},{"fixed":"4.6.25","introduced":"4.6.0"}],"component":"ibexa/fieldtype-richtext","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.0.3","4.6.25"],"ghsa_id":"GHSA-8c2g-f8jm-5cr7","id":"tcs_01M5KEYX9S5TJ781N5Y07P8ZC8","modified_at":"2025-10-17T18:18:52.009407Z","published_at":"2025-10-17T18:05:09Z","references":["https://osv.dev/vulnerability/GHSA-8c2g-f8jm-5cr7","https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-8c2g-f8jm-5cr7","https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office","https://github.com/ibexa/fieldtype-richtext"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8c2g-f8jm-5cr7","url":"https://osv.dev/vulnerability/GHSA-8c2g-f8jm-5cr7"}],"summary":"ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text"}