What is the CVSS score of CVE-2025-49582?

CVE-2025-49582 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Python are affected by CVE-2025-49582?

CVE-2025-49582 is a critical remote code execution vulnerability in XWiki that allows attackers to bypass security warnings and inject malicious code into wiki pages.. A patch is available.

Is there a public PoC exploit available for CVE-2025-49582?

Yes, a public proof-of-concept exploit is available for CVE-2025-49582. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-49582?

Within 24 hours: Inventory all XWiki instances and assess which versions are running; prioritize systems containing sensitive data or connected to critical infrastructure. Within 7 days: Apply the available vendor patch to all XWiki instances; if patching cannot be completed immediately, restrict edit permissions to trusted users only and disable Groovy and Python macro execution where possible. Within 30 days: Conduct a comprehensive audit of recently modified wiki pages for signs of malicious macro injection; review edit logs for suspicious activity by lower-privileged accounts; implement enhanced monitoring for macro execution patterns.

Python CVE-2025-49582

EUVD-2025-18293 HIGH

Insufficient UI Warning of Dangerous Operations (CWE-357)

2025-06-13 security-advisories@github.com

GHSA-c32m-27pj-4xcj

Python RCE Xwiki

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18293

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

Patch released

Mar 14, 2026 - 21:34 nvd

Patch available

PoC Detected

Sep 03, 2025 - 17:50 vuln.today

Public exploit code

CVE Published

Jun 13, 2025 - 17:15 nvd

HIGH 8.0

DescriptionGitHub Advisory

XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

AnalysisAI

XWiki's macro rights analyzer introduced in version 15.9RC1 contains incomplete validation that allows attackers to hide malicious script macros (Groovy, Python) by exploiting non-lowercase parameter handling and unanalyzed macro parameters. An authenticated attacker with limited privileges can inject hidden malicious macros that execute when a higher-privileged user edits the page, enabling remote code execution. This vulnerability affects XWiki versions 15.9RC1 through 16.4.6, 16.10.0-16.10.2, and 16.x-17.0.0-rc1, with patches available in versions 16.4.7, 16.10.3, and 17.0.0.

Technical ContextAI

XWiki is a Java-based wiki platform that supports dynamic macro execution including dangerous macros (script, Groovy, Python) that require programming rights. The vulnerability stems from incomplete implementation of CWE-357 (Insufficient UI Warning of Dangerous Operations), specifically in the rights analyzer components introduced to warn users about macro execution risks. The root cause involves three distinct gaps: (1) parameter analysis limited to lowercase variants, allowing case-variant bypass; (2) failure to analyze macro parameters containing XWiki syntax such as information box titles; (3) insufficient analysis of 'source' parameters in content and context macros that can embed arbitrary XWiki syntax. The analyzer should prevent users without programming rights from silently injecting executable macros, but the incomplete checks allow obfuscation techniques to bypass these safeguards.

RemediationAI

priority: CRITICAL; action: Upgrade to patched versions; details: Apply security patches immediately: XWiki 16.4.7, 16.10.3, or 17.0.0 depending on installed branch. These versions include enhanced rights analyzers that properly validate macro parameters regardless of case, analyze parameters containing XWiki syntax, and inspect 'source' parameters in content/context macros.
priority: HIGH; action: Access control hardening; details: Restrict edit permissions to trusted users only. Disable or restrict macro usage (especially script/Groovy/Python macros) for non-programming users through XWiki permission model. Review existing page history for suspicious macro usage patterns, particularly case-variant parameters or obfuscated source attributes.
priority: MEDIUM; action: Detection and monitoring; details: Enable audit logging for page edits. Monitor for macros with mixed-case parameters (e.g., 'Script' vs 'script', 'SCRIPT') and 'source' parameters containing embedded syntax. Search wiki content for patterns: {{script...}}, {{groovy...}}, {{python...}} with non-standard casing or source parameter usage.
priority: LOW; action: Temporary mitigation (if patching delayed); details: Disable dangerous macro types (Script, Groovy, Python) via XWiki configuration if not required for operations. This removes attack surface but may break dependent functionality. Requires configuration rebuild and wiki restart.