PT-2025-25433 · Xwiki · Xwiki

Michael Hamann · Published 2025-02-07 · Updated 2025-09-03 · CVE-2025-49582

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.3 XWiki versions prior to 17.0.0

Description XWiki is a generic wiki platform that warns about the execution of "dangerous" macros like malicious script macros authored by a user with fewer rights since XWiki 15.9RC1. However, the required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. The existing analyzers do not consider non-lowercase parameters, and most macro parameters that can contain XWiki syntax were not analyzed. This could allow a malicious user to add malicious script macros, including Groovy or Python macros, to a page that are then executed after another user with programming rights edits the page, thus allowing remote code execution.

Recommendations For versions prior to 16.4.7, update to version 16.4.7 or later. For versions prior to 16.10.3, update to version 16.10.3 or later. For versions prior to 17.0.0, update to version 17.0.0 or later. As a temporary workaround, consider being careful when editing content authored by untrusted users.

Exploit

Fix

RCE

Protection Mechanism Failure

Weakness Enumeration

CWE-357

CWE-693

Related Identifiers

BDU:2025-06833

CVE-2025-49582

GHSA-C32M-27PJ-4XCJ

Affected Products

Xwiki

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49582.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c · Patch
• https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7 · Patch
• https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8 · Patch
• https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd · Patch
• https://bdu.fstec.ru/vul/2025-06833 · Security Note
• https://osv.dev/vulnerability/GHSA-c32m-27pj-4xcj · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22799 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49582 · Security Note
• https://jira.xwiki.org/browse/XWIKI-22763 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49582 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22758 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note