PT-2025-36511 · Xwiki · Xwiki

Michitux · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-58365

Positive Technologies · (AI Summary)

CVSS v4.0

8.7

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions:

XWiki versions prior to 9.14

Description:

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application allowed remote code execution for any logged-in user with edit rights on any page. Exploitation involves adding an object of type `Blog.BlogPostClass` to any page and adding script code to the "Content" field of that object. The vulnerability was addressed in version 9.14 by executing the content of blog posts with the rights of the appropriate author.

Recommendations:

Upgrade to XWiki version 9.14 or later.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-58365

Affected Products

Xwiki

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-58365 · Security Note
• https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4 · Note
• https://github.com/xwiki-contrib/application-blog/security/advisories/GHSA-gwj6-xpfg-pxwr · Note
• https://twitter.com/VulmonFeeds/status/1965192699503337739 · Twitter Post
• https://jira.xwiki.org/browse/BLOG-191 · Note
• https://twitter.com/CVEnew/status/1965167916812275964 · Twitter Post