Vulnerability · Published Jun 13, 2025 · Assigned by GitHub_M
CVE-2025-49580XWiki allows privilege escalation through link refactoring
High 8.5
In plain English
A high-severity security flaw in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-refactoring-default | 17.1.0-rc-1 | GHSA-jm43-hrq7-r7w6 |
| Maven | org.xwiki.platform:xwiki-platform-refactoring-default | 16.10.4 | GHSA-jm43-hrq7-r7w6 |
| Maven | org.xwiki.platform:xwiki-platform-refactoring-default | 16.4.7 | GHSA-jm43-hrq7-r7w6 |
| Maven | org.xwiki.platform:xwiki-platform-refactoring-default | 16.4.7 | GHSA-jm43-hrq7-r7w6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 17.0.0-rc-1, < 17.1.0-rc-1>= 16.5.0-rc-1, < 16.10.4>= 8.2, < 16.4.7>= 7.4.5, < 8.0-milestone-1 |
Weakness: CWE-266 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6 x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-22836 x_refsource_MISC