PT-2025-25437 · Xwiki · Xwiki

Michitux · Published 2024-09-02 · Updated 2025-06-13 · CVE-2025-49585

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions before 15.10.16 XWiki versions 16.0.0-rc-1 through 16.4.6 XWiki versions 16.5.0-rc-1 through 16.10.1

Description The issue concerns XWiki, a generic wiki platform. In affected versions, an attacker without script or programming rights can create an XClass definition, which can lead to malicious code execution when a user with script, admin, or programming rights later edits the document. This is particularly relevant to custom display code, script of computed properties, and queries in database list properties. Warnings for editing documents with dangerous properties were introduced in XWiki 15.9.

Recommendations For versions before 15.10.16, update to version 15.10.16 or later. For versions 16.0.0-rc-1 through 16.4.6, update to version 16.4.7 or later. For versions 16.5.0-rc-1 through 16.10.1, update to version 16.10.2 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-357

Related Identifiers

BDU:2025-06831

CVE-2025-49585

GHSA-59W6-R9HM-439H

Affected Products

Xwiki

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49585.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-59w6-r9hm-439h · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/385bde985cdb61ebf315d30c0b144b6d2e2c2d45 · Patch
• https://osv.dev/vulnerability/GHSA-59w6-r9hm-439h · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-22476 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49585 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06831 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49585 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/VulmonFeeds/status/1933618933245849989 · Twitter Post
• https://t.me/latest_high_impact_cve/2653 · Telegram Post
• https://twitter.com/CVEnew/status/1933582822708510970 · Twitter Post
• https://t.me/cvetracker/26211 · Telegram Post
• https://twitter.com/CveFindCom/status/1933587812651073766 · Twitter Post