This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] XWiki fixes 9 vulnerabilities
XWiki versions 16.4.7, 16.10.3 and 17.0.0 fix 9 vulnerabilities. The most severe of them are described below; the remaining ones can be found at [1][2][3].
An unauthenticated remote attacker can perform a SQL injection attack against an Oracle database via the REST API, using functions such as DBMS_XMLGEN or DBMS_XMLQUERY [4].
The vulnerability is present in product:
- XWiki; >=1.0, <15.10.16; >=16.4, <16.4.7; >=16.10, <16.10.2;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2024-56158 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 6. 2025.
An authenticated remote attacker with page editing permission can execute arbitrary code (Groovy, Python, Velocity) with programmer rights, due to incorrect evaluation of default parameter values in user-defined wiki macros, which may lead to complete compromise of the XWiki installation [5]. More information and a PoC for the vulnerability can be found at [5][6].
The vulnerability is present in product:
- XWiki; >=11.10.11, <12.0; >=12.6.3, <12.7; >=12.8-rc-1, <16.4.7; >=16.5.0-rc-1, <16.10.3; >=17.0.0-rc-1, <17.0.0;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-49581 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 6. 2025.
An unauthenticated remote attacker can read, via the REST API, the titles of pages to which they have no access permission, provided they know their exact reference and have access to an XClass containing a property of type 'page', which may lead to disclosure of sensitive information about the content and structure of the wiki [7]. Fully private wikis [8] are not affected by this vulnerability.
The vulnerability is present in product:
- XWiki; >=10.9, <16.4.7; >=16.5.0-rc-1, <16.10.3; >=17.0.0-rc-1, <17.0.0;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-49584 at cve.org, NVD
- CWE-201: Insertion of Sensitive Information Into Sent Data at cwe.mitre.org
The vulnerability was publicly disclosed 13. 6. 2025.
An authenticated remote attacker with permission to edit at least one application created using App Within Minutes (AWM) can execute arbitrary code with programmer rights by modifying it [9]. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by restricting the right to edit all existing applications created using AWM to trusted users only. However, this measure mitigates only the known method of exploitation (PoC), and the existence of others cannot be ruled out. More information and a PoC for the vulnerability can be found at [9][10].
The vulnerability is present in product:
- XWiki; >=7.2-milestone-2, <16.4.7; >=16.5.0-rc-1, <16.10.3; >=17.0.0-rc-1, <17.0.0;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-49586 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 13. 6. 2025.
An authenticated remote attacker with page editing permission can hide a malicious script (including Groovy or Python) in macro parameters, due to an incomplete implementation of warnings about dangerous macros; the script is subsequently executed with programmer rights when another user edits the page. More information about the vulnerability can be found at [11].
The vulnerability is present in product:
- XWiki; >=15.9-rc-1, <16.4.7; >=16.5.0-rc-1, <16.10.3; >=17.0.0-rc-1, <17.0.0;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-49582 at cve.org, NVD
- CWE-357: Insufficient UI Warning of Dangerous Operations at cwe.mitre.org
The vulnerability was publicly disclosed 13. 6. 2025.
An authenticated remote attacker with page editing permission can insert malicious code, due to the absence of a warning when editing documents with dangerous properties, which is then executed with the rights of a user with higher privileges (e.g. a programmer) [12].
The vulnerability is present in product:
- XWiki; <15.10.16; >=16.0.0-rc-1, <16.4.7; >=16.5.0-rc-1, <16.10.2;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
More information:
- CVE-2025-49585 at cve.org, NVD
- CWE-357: Insufficient UI Warning of Dangerous Operations at cwe.mitre.org
The vulnerability was publicly disclosed 13. 6. 2025.
Links
- [1] https://nvd.nist.gov/vuln/detail/CVE-2025-49580
- [2] https://nvd.nist.gov/vuln/detail/CVE-2025-49587
- [3] https://nvd.nist.gov/vuln/detail/CVE-2025-49583
- [4] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82
- [5] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9875-cw22-f7cx
- [6] https://jira.xwiki.org/browse/XWIKI-22760
- [7] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv
- [8] https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Access%20Rights/#HPrivateWiki
- [9] https://github.com/advisories/GHSA-jp4x-w9cj-97q7
- [10] https://jira.xwiki.org/browse/XWIKI-22719
- [11] https://github.com/advisories/GHSA-c32m-27pj-4xcj
- [12] https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-59w6-r9hm-439h
By CESNET, z.s.p.o. Michaela Ručková on 17. 6. 2025.