CVE-2025-49580

HIGH EPSS 28.7%
Published Jun 13, 20251y ago · Modified Jun 17, 20262w ago
8.5 CVSS 4.0
High
Find Similar
Published Jun 13, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.

CVSS Details

Base Score
8.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
28.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-266

Affected Products 3

VendorProductVersionRange
xwikixwiki*≥7.4.5  –  <16.4.7
xwikixwiki*≥16.5.0  –  <16.10.4
xwikixwiki*≥17.0.0  –  <17.1.0

References 3

  • github.com https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec
    Patch
  • github.com https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6
    Vendor Advisory
  • jira.xwiki.org https://jira.xwiki.org/browse/XWIKI-22836
    ExploitIssue TrackingVendor Advisory

Remediation

  • github.com https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec
    Patch