CVE-2025-49582: Xwiki remote code execution (CVSS 8.0)

Description

XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Xwiki≥ 15.9 < 16.4.7 · ≥ 16.5.0 < 16.10.3 · 17.0.0

Remediation

Fixed in

Xwiki≥ 16.4.7

Patch & vendor advisories

References

https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bdPatch
https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971cPatch
https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8Patch
https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcjVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22758ExploitIssue TrackingVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22759ExploitIssue TrackingVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22763ExploitIssue TrackingVendor Advisory
https://jira.xwiki.org/browse/XWIKI-22799ExploitIssue TrackingVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-49582 being actively exploited?

CVE-2025-49582 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.89%.

How severe is CVE-2025-49582?

CVE-2025-49582 has a CVSS 3.1 base score of 8.0, rated high. EPSS estimates a 0.89% probability of exploitation.

Which products are affected by CVE-2025-49582?

Affected products include Xwiki.

How do I fix CVE-2025-49582?

Upgrade affected software to a fixed version, for example Xwiki 16.4.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-49582 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo