CVE-2025-48063: Xwiki remote code execution (CVSS 8.8)

Description

XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which required rights are enforced can be sure that they're not giving a right to a script or object that it didn't have before. A bug in the implementation of the enforcement of this rule means that in fact, it was possible for any user with edit right on a document to set programming right as required right. If then a user with programming right edited that document, the content of that document would gain programming right, allowing remote code execution. This thereby defeats most of the security benefits of required rights. As XWiki still performs the required rights analysis when a user edits a page even when required rights are enforced, the user with programming right would still be warned about the dangerous content unless the attacker managed to bypass this check. Note also that none of the affected versions include a UI for enabling the enforcing of required rights so it seems unlikely that anybody relied on them for security in the affected versions. As this vulnerability provides no additional attack surface unless all documents in the wiki enforce required rights, we consider the impact of this attack to be low even though gaining programming right could have a high impact. This vulnerability has been patched in XWiki 16.10.4 and 17.1.0RC1. No known workarounds are available except for upgrading.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Xwiki≥ 16.10.0 < 16.10.4 · 17.0.0

Remediation

Fixed in

Xwiki≥ 16.10.4

Patch & vendor advisories

References

https://github.com/xwiki/xwiki-platform/commit/2557813aef3b863988d6cca58de996e207086898Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rhfv-688c-p6hpPatchVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22859ExploitPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-48063 being actively exploited?

CVE-2025-48063 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.96%.

How severe is CVE-2025-48063?

CVE-2025-48063 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.96% probability of exploitation.

Which products are affected by CVE-2025-48063?

Affected products include Xwiki.

How do I fix CVE-2025-48063?

Upgrade affected software to a fixed version, for example Xwiki 16.10.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-48063 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo