Vulnerability · Published Jun 13, 2025 · Assigned by GitHub_M
CVE-2025-49586XWiki allows remote code execution through preview of XClass changes in AWM editor
High 8.7
In plain English
A high-severity incorrect authorization in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 16.4.7 | GHSA-jp4x-w9cj-97q7 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 16.10.3 | GHSA-jp4x-w9cj-97q7 |
| Maven | org.xwiki.platform:xwiki-platform-oldcore | 17.0.0 | GHSA-jp4x-w9cj-97q7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 7.2-milestone-2, < 16.4.7>= 16.5.0-rc-1, < 16.10.3>= 17.0.0-rc-1, < 17.0.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7 x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-22719 x_refsource_MISC