CVE-2025-49587: Xwiki vulnerability (CVSS 8.0)

Description

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Xwiki≥ 15.9 < 15.10.16 · ≥ 16.0.0 < 16.4.7 · ≥ 16.5.0 < 16.10.2

Remediation

Fixed in

Xwiki≥ 15.10.16

Patch & vendor advisories

References

https://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252dPatch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-22470ExploitIssue TrackingVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-49587 being actively exploited?

CVE-2025-49587 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.43%.

How severe is CVE-2025-49587?

CVE-2025-49587 has a CVSS 3.1 base score of 8.0, rated high. EPSS estimates a 0.43% probability of exploitation.

Which products are affected by CVE-2025-49587?

Affected products include Xwiki.

How do I fix CVE-2025-49587?

Upgrade affected software to a fixed version, for example Xwiki 15.10.16 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-49587 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo