Xwiki CVE-2025-49580

CVSS 8.0 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates significant real-world risk. Attack Vector is Network (exploitable remotely), Attack Complexity is Low (easily reproducible), and Privileges Required are Low (non-administrative users can exploit). However, User Interaction is Required (UI:R), which moderately reduces exploitation probability in automated attack scenarios. The vulnerability requires an authenticated attacker to craft a page with a link and then coordinate a page rename/move operation—a constraint that limits mass exploitation. The Confidentiality, Integrity, and Availability impacts are all High, indicating complete system compromise is possible through script execution. The CWE-266 classification (Improper Privilege Management) is appropriately assigned and suggests the root cause is a logic flaw rather than a memory corruption or injection issue. Without explicit EPSS or KEV data provided, the CVSS score and attack vector suggest this is a real priority for XWiki administrators—particularly those in environments where users have page creation/editing rights. The requirement for user interaction (UI:R) and low privileges (PR:L) make this exploitable by low-privileged collaborators rather than completely unauthenticated attackers, placing it in the medium-to-high real-world risk category depending on organizational trust models.

An attacker with low-level user privileges in an XWiki instance creates a page (PageA) with a link to another page (PageB). PageA also contains an embedded XObject with malicious Groovy script that would normally be restricted from execution due to the user's lack of 'Script' or 'Programming' rights. An administrator or another user with rename/move permissions then moves or renames PageB. When a user (including the attacker) subsequently visits PageA, the page rendering engine re-evaluates the link to the renamed PageB. Due to the vulnerability, this re-evaluation process incorrectly grants script execution rights to the embedded XObject within PageA. The malicious Groovy script executes with elevated privileges, allowing the attacker to read/modify wiki content, extract user credentials, escalate to administrative privileges, or pivot to the underlying server. The user interaction requirement (UI:R) means either the attacker visits their own malicious page or tricks another user into visiting it, making this a plausible social engineering vector in collaborative environments. No public POC is referenced, but the low attack complexity and network accessibility make weaponization straightforward once discovered.