PT-2025-35113 · Xwiki · Xwiki Platform

Michael Hamann · Published 2025-08-28 · Updated 2025-12-27 · CVE-2025-58049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 14.4.2 through 16.4.7 XWiki Platform versions 16.5.0-rc-1 through 16.10.6 XWiki Platform versions 17.0.0-rc-1 through 17.4.0-rc-1

Description: The PDF export jobs store sensitive cookies unencrypted in job statuses. This includes the encrypted username and password, which effectively exposes the plain text password if the encryption key is compromised. The encryption key is stored in the same data directory as the job status, making it accessible. The vulnerability exists because the job status includes cookies from the HTTP request that triggered the export.

Recommendations: Upgrade to XWiki Platform version 16.4.8 or later. Upgrade to XWiki Platform version 16.10.7 or later. Upgrade to XWiki Platform version 17.4.0-rc-1 or later.

Exploit

Fix

Weakness Enumeration

CWE-257

CWE-212

Related Identifiers

CVE-2025-58049

GHSA-9M7C-M33F-3429

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58049.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 · Patch
• https://jira.xwiki.org/browse/XWIKI-23151 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58049 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m7c-m33f-3429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58049 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/VulmonFeeds/status/1961175061659832506 · Twitter Post
• https://twitter.com/CVEnew/status/2005031797931856339 · Twitter Post
• https://t.me/CVEtracker/31152 · Telegram Post