CVE-2025-49587

Description

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-357 CWE-357

Affected Products

Vendor	Product	Versions
xwiki	xwiki	15.9 — 15.10.16
xwiki	xwiki	16.0.0 — 16.4.7
xwiki	xwiki	16.5.0 — 16.10.2

References

Advisories & Patches

https://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252d https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7 https://jira.xwiki.org/browse/XWIKI-22470

Exploits

https://jira.xwiki.org/browse/XWIKI-22470

Frequently Asked Questions

What is CVE-2025-49587? +

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2025-49587? +

CVE-2025-49587 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-49587? +

CVE-2025-49587 affects products from xwiki, specifically: xwiki. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-49587? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.