What is the CVSS score of CVE-2025-49580?

CVE-2025-49580 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Xwiki are affected by CVE-2025-49580?

XWiki instances are vulnerable to privilege escalation attacks where malicious scripts can gain execution rights through renamed or moved page links, potentially allowing unauthorized code execution.. A patch is available.

Is there a public PoC exploit available for CVE-2025-49580?

Yes, a public proof-of-concept exploit is available for CVE-2025-49580. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-49580?

Within 24 hours: inventory all XWiki instances and their versions; assess exposure by identifying instances accessible from untrusted networks. Within 7 days: apply patches (17.1.0-rc-1, 16.10.4, or 16.4.7) to all affected systems following change management procedures; prioritize internet-facing deployments. Within 30 days: complete patching of all remaining instances and conduct post-patch testing to confirm functionality.

Xwiki CVE-2025-49580

EUVD-2025-18286 HIGH

Incorrect Privilege Assignment (CWE-266)

2025-06-13 security-advisories@github.com

GHSA-jm43-hrq7-r7w6

Information Disclosure Xwiki

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18286

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

Patch released

Mar 14, 2026 - 21:34 nvd

Patch available

PoC Detected

Sep 03, 2025 - 17:52 vuln.today

Public exploit code

CVE Published

Jun 13, 2025 - 16:15 nvd

HIGH 8.0

DescriptionGitHub Advisory

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.

AnalysisAI

Privilege escalation vulnerability in XWiki where pages can unexpectedly gain script or programming rights when they contain links to pages that are subsequently renamed or moved. This allows attackers with low privileges to execute arbitrary scripts embedded in XObjects that should have been restricted, potentially leading to complete system compromise. The vulnerability affects XWiki versions 8.2 through 17.0.x and requires user interaction (page visit) to trigger, with patches available in 17.1.0-rc-1, 16.10.4, and 16.4.7.

Technical ContextAI

XWiki is a Java-based collaborative wiki platform that supports embedded scripting through XObjects (custom data structures) and Velocity/Groovy templating. The vulnerability stems from a privilege escalation flaw (CWE-266: Improper Privilege Management) in the link resolution and page renaming/moving mechanisms. When a page containing a link is accessed after its target has been renamed or moved, the platform fails to properly re-evaluate and maintain the security context of embedded scripts within XObjects. The affected component likely involves the page rendering engine and link resolution subsystem that does not properly isolate privilege contexts during page metadata updates. The vulnerability chain requires that XObjects with script content remain associated with pages even after their link targets change, bypassing the intended privilege restrictions that would normally prevent script execution in user-editable content.

RemediationAI

Immediate actions: (1) Upgrade to patched versions: 17.1.0-rc-1 (development/RC), 16.10.4 (LTS), or 16.4.7 (legacy) depending on deployment. (2) If immediate patching is not feasible, implement access controls to restrict page creation and link modification privileges to trusted users only. (3) Audit all pages containing links to recently renamed/moved pages and review embedded XObjects for script content. (4) Monitor page rename/move operations and cross-reference with pages containing links to detect exploitation attempts. (5) Disable Groovy/Velocity script execution in XObjects if not required for operational needs, using XWiki's scripting restrictions. (6) Apply the XWiki security advisory patch when available from xwiki.org/security advisories. Workaround (temporary): Restrict the 'Rename' and 'Move' page permissions to administrators only, reducing the attack surface. This does not eliminate the vulnerability for admin-performed operations but limits exposure.