PT-2025-25430 · Xwiki · Xwiki

Simon Urli · Published 2025-06-13 · Updated 2025-09-03 · CVE-2025-49580

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions 7.4.5 through 16.4.7 XWiki versions 8.2 through 16.10.4 XWiki versions 17.1.0-rc-1 and earlier

Description The issue allows pages to gain script or programming rights when they contain a link and the target of the link is renamed or moved, potentially leading to the execution of scripts contained in xobjects that should not have been executed.

Recommendations For XWiki versions 7.4.5 through 16.4.7, update to version 16.4.7 or later. For XWiki versions 8.2 through 16.10.4, update to version 16.10.4 or later. For XWiki versions 17.1.0-rc-1 and earlier, update to version 17.1.0-rc-1 or later.

Exploit

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-13440

CVE-2025-49580

GHSA-JM43-HRQ7-R7W6

Affected Products

Xwiki

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec · Patch
• https://osv.dev/vulnerability/CVE-2025-49580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49580 · Security Note
• https://bdu.fstec.ru/vul/2025-13440 · Security Note
• https://jira.xwiki.org/browse/XWIKI-22836 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jm43-hrq7-r7w6 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/latest_high_impact_cve/2650 · Telegram Post
• https://t.me/cveNotify/134227 · Telegram Post
• https://t.me/cvetracker/26204 · Telegram Post
• https://twitter.com/CveFindCom/status/1933557534339600808 · Twitter Post
• https://twitter.com/CVEnew/status/1933553095533080989 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1933583095237591144 · Twitter Post