What is CVE-2025-47292?

CVE-2025-47292 is a vulnerability in Cap-Collectif, classified under Deserialization of Untrusted Data. Published 2025-05-14.

Is CVE-2025-47292 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Cap-Collectif

CVE-2025-47292

Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternateArgumentsResolver` deserializes a `Cursor`, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.

Vulnerability class: Insecure Deserialization

EPSS: 0.006 (44.4th percentile) — read the EPSS interpretation.

Affected products

Cap-collectif — versions < 812f2a7d271b76deab1175bdaf2be0b8102dd198

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-47292?: CVE-2025-47292 is a vulnerability in Cap-Collectif, classified under Deserialization of Untrusted Data. Published 2025-05-14.
Is CVE-2025-47292 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.