EUVD-2026-267177

fkie_cve-2025-65017

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

GHSA-3cx6-j9j4-54mp — Decidim's private data exports can lead to data leaks

Affected: RubyGems: decidim-core, RubyGems: decidim

### Impact Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs.

The bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23).

This issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug:

```bash $ cd decidim-core $ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/download_your_data_export_job_spec.rb -e "deletes the" || break ; done ```

Run the spec as many times as needed to hit a UUID that converts to `0` through `.to_i`.

The UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example.

The following code regenerates the issue by assigning a predefined UUID that will generate a collision (example assumes there are already two existing users in the system):

```ruby # Create the ZIP buffers to be stored buffer1 = Zip::OutputStream.write_buffer do |out| out.put_next_entry("admin.txt") out.write "Hello, admin!" end buffer1.rewind buffer2 = Zip::OutputStream.write_buffer do |out| out.put_next_entry("user.txt") out.write "Hello, user!" end buffer2.rewind

# Create the private exports with a predefined IDs user1 = Decidim::User.find(1) export = user1.private_exports.build export.id = "0210ae70-482b-4671-b758-35e13e0097a9" export.export_type = "download_your_data" export.file.attach(io: buffer1, filename: "foobar.zip", content_type…

Most recent entries from all

EUVD-2026-267177

fkie_cve-2025-65017

GHSA-3cx6-j9j4-54mp — Decidim's private data exports can lead to data leaks