Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

XWiki allows malicious code to be executed via admin edit

CVE-2025-49587 · published 1 year ago
Summary

An attacker can inject malicious code into XWiki, which can be executed when an admin edits a document. This can happen if a user without permission creates a document with malicious code and an admin later edits it. If you use XWiki, make sure you're running version 15.10.16 or later, or upgrade to the latest version to fix this issue.

What to do
  • Update xwiki org.xwiki.platform:xwiki-platform-notifications-notifiers-default to version 15.10.16.
  • Update xwiki org.xwiki.platform:xwiki-platform-notifications-notifiers-default to version 16.4.7.
  • Update xwiki org.xwiki.platform:xwiki-platform-notifications-notifiers-default to version 16.10.2.
Affected software
Ecosystem VendorProductAffected versions
maven xwiki org.xwiki.platform:xwiki-platform-notifications-notifiers-default >= 15.9-rc-1, < 15.10.16
>= 16.0.0-rc-1, < 16.4.7
>= 16.5.0-rc-1, < 16.10.2
Fix: upgrade to 15.10.16
– xwiki xwiki >= 15.9, < 15.10.16
>= 16.0.0, < 16.4.7
>= 16.5.0, < 16.10.2
cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
Original advisory text
XWiki does not require right warnings for notification displayer objects
XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-357Insufficient UI Warning of Dangerous Operations
Timeline
Published13 Jun 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-j7p2-87q3-44w7 · GHSA
CVE-2025-49587 · NVD
CVE-2025-49587 · OSV
Track software like this
Free during beta