PT-2025-34072 · Xwiki · Xwiki

Malcxlmj · Published 2025-08-16 · Updated 2025-09-09 · CVE-2025-51991

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: XWiki versions through 17.3.0

Description: XWiki is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the server side without proper validation or sandboxing. This enables the execution of arbitrary template logic, potentially exposing internal server information or leading to further exploitation, such as remote code execution or sensitive data leakage. The vulnerability resides in improper handling of dynamic template rendering within user-supplied configuration fields.

Recommendations: Versions prior to 17.3.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

BDU:2025-13437

CVE-2025-51991

Affected Products

Xwiki

References · 9

• 🔥 https://github.com/malcxlmj/cve-writeups/blob/main/CVE-2025-51991.md · Exploit
• https://bdu.fstec.ru/vul/2025-13437 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-51991 · Security Note
• https://osv.dev/vulnerability/CVE-2025-51991 · Vendor Advisory
• https://xwiki.org · Note
• https://twitter.com/itheodorakos808/status/1960651438247317616 · Twitter Post
• https://twitter.com/CVEnew/status/1958186507900260627 · Twitter Post
• https://t.me/CVEtracker/30491 · Telegram Post
• https://twitter.com/itheodorakos808/status/1965417027860078733 · Twitter Post