Stored Cross-site Scripting in Galette
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds.
Why it matters now
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Fixed galette (galette): 0.9.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA galette (galette) Fixed in 0.9.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41261
References
More Galette vulnerabilities
- TI-2024-16278 Galette public pages accessibility restriction CVSS 3.1HIGH 7.5
- TI-2025-35895 Galette has groups managers access control bypass on Members CVSS 4.0LOW 2.1
- TI-2021-18094 SQL Injection in Galette CVSS 3.1HIGH 8.8
- TI-2021-18092 Missing CSRF checks in Galette CVSS 3.1HIGH 8.8
- TI-2021-04419 Several stored XSS CVSS 3.1MEDIUM 6.8
- TI-2025-31034 Galette is vulnerable to XSS through Document Type CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences