What is the CVSS score of CVE-2025-49581?

CVE-2025-49581 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Python are affected by CVE-2025-49581?

XWiki installations are vulnerable to arbitrary code execution through wiki macro manipulation, allowing attackers with basic edit permissions to gain full system access.. A patch is available.

Is there a public PoC exploit available for CVE-2025-49581?

Yes, a public proof-of-concept exploit is available for CVE-2025-49581. Prioritise patching immediately. EPSS: 1.6%.

How to fix or mitigate CVE-2025-49581?

Within 24 hours: Identify all XWiki instances and their versions in your environment; restrict edit permissions on user profiles and system pages to administrative users only. Within 7 days: Apply vendor patches (upgrade to XWiki 16.4.7, 16.10.3, or 17.0.0). Within 30 days: Conduct access review of all XWiki users with edit rights; implement audit logging for macro creation and document modifications; validate patch deployment across all instances.

Python CVE-2025-49581

EUVD-2025-18284 HIGH

Code Injection (CWE-94)

2025-06-13 security-advisories@github.com

Python RCE Xwiki

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18284

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

Patch released

Mar 14, 2026 - 21:34 nvd

Patch available

PoC Detected

Sep 03, 2025 - 17:51 vuln.today

Public exploit code

CVE Published

Jun 13, 2025 - 16:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main problem is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where it is used. This can be exploited by overriding a macro like the children macro that is used in a page that has programming right like the page XWiki.ChildrenMacro and thus allows arbitrary script macros. This vulnerability has been patched in XWiki 16.4.7, 16.10.3 and 17.0.0 by executing wiki parameters with the rights of the wiki macro's author when the parameter's value is the default value.

AnalysisAI

Critical privilege escalation vulnerability in XWiki that allows any user with page edit rights to execute arbitrary code (Groovy, Python, Velocity) with programming-level privileges by creating malicious wiki macros. An attacker can exploit wiki macro parameter defaults to inject code into high-privilege pages like XWiki.ChildrenMacro, achieving full XWiki installation compromise. The vulnerability affects XWiki versions prior to 16.4.7, 16.10.3, and 17.0.0; patch availability is confirmed across multiple release branches.

Technical ContextAI

XWiki is a Java-based wiki platform that supports extensible macro scripting through multiple languages (Groovy, Python, Velocity). The vulnerability stems from CWE-94 (Improper Control of Generation of Code), specifically in how wiki macro parameters with wiki syntax support are evaluated. When a macro parameter's default value contains wiki syntax, it is executed with the document author's rights rather than the macro definition author's rights. This creates a privilege escalation chain: (1) an attacker with edit rights defines a custom wiki macro with a parameter allowing wiki syntax, (2) the attacker sets a malicious default value, (3) when this macro is invoked in a high-privilege document (e.g., XWiki.ChildrenMacro in the XWiki namespace which has programming rights), the default parameter value executes with those elevated rights. The affected product range includes XWiki Community and Enterprise editions across multiple major versions (14.x, 15.x, 16.x, 17.x branches).

RemediationAI

Immediate patching is required: upgrade to XWiki 16.4.7 or later (for 16.4.x branch), 16.10.3 or later (for 16.10.x branch), or 17.0.0 or later (for 17.x branch). The patch changes macro parameter evaluation logic to execute wiki syntax default values with the wiki macro author's rights (not the invoking document author's rights), eliminating the privilege escalation. For organizations unable to patch immediately: (1) restrict edit page rights to highly trusted users only; (2) audit existing custom wiki macros for suspicious definitions; (3) monitor wiki modification logs for users creating new macros; (4) disable user self-service page editing if feasible; (5) implement network segmentation to limit XWiki installation exposure. Vendor advisory and patches are available through XWiki's official release channels (xwiki.org/download). No known workaround exists that fully protects unpatched systems while maintaining wiki functionality.