PT-2025-36511 · Xwiki · Xwiki

Michitux · Published 2025-09-08 · Updated 2025-09-09 · CVE-2025-58365

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 9.14

Description: The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application allowed remote code execution for any logged-in user with edit rights on any page. Exploitation involves adding an object of type Blog.BlogPostClass to any page and adding script code to the "Content" field of that object. The vulnerability was addressed in version 9.14 by executing the content of blog posts with the rights of the appropriate author.

Recommendations: Upgrade to XWiki version 9.14 or later.

Exploit

Fix

LPE

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

CWE-250

Related Identifiers

CVE-2025-58365

GHSA-GWJ6-XPFG-PXWR

Affected Products

Xwiki

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58365.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58365 · Security Note
• https://osv.dev/vulnerability/GHSA-gwj6-xpfg-pxwr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58365 · Vendor Advisory
• https://github.com/xwiki-contrib/application-blog · Note
• https://github.com/xwiki-contrib/application-blog/security/advisories/GHSA-gwj6-xpfg-pxwr · Note
• https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4 · Note
• https://jira.xwiki.org/browse/BLOG-191 · Note
• https://twitter.com/VulmonFeeds/status/1965192699503337739 · Twitter Post
• https://t.me/CVEtracker/31991 · Telegram Post
• https://twitter.com/CVEnew/status/1965167916812275964 · Twitter Post