EUVD-2025-18293
GHSA-c32m-27pj-4xcj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V6 - Authentication Insufficient UI warning of dangerous op
|
| Impact | This vulnerability presents HIGH real-world risk despite requiring low attack complexity (PR:L, UI:R). Risk signals: CVSS 8.0 indicates high confidentiality, integrity, and availability impact with network accessibility. The requirement for Low privileges (PR:L) and user interaction (UI:R) reduces immediate exploitability but doesn't diminish impact—once a higher-privileged user edits the poisoned page, RCE occurs with full system compromise. The vulnerability follows a privilege escalation pattern: low-privilege attacker creates hidden payload, high-privilege user inadvertently triggers execution. No KEV or public POC data provided, but the technical simplicity of the bypass (case variation, parameter obfuscation) suggests moderate exploitation probability. Organizational risk depends heavily on wiki access control: if regular users can create/edit pages, likelihood increases substantially. This should be prioritized for patching in internet-facing XWiki instances. |
| Exploit ScenarioDerived | An authenticated low-privilege user (e.g., regular content editor without programming rights) creates a wiki page containing a hidden malicious Groovy macro. The attacker obfuscates the macro by: (1) using uppercase variant 'Script' instead of 'script' to bypass lowercase-only analyzer; (2) embedding the malicious code in a macro parameter that should only contain display text, like a box title parameter that isn't analyzed; or (3) using the 'source' parameter of a context macro to inject arbitrary XWiki syntax that includes a Groovy macro. The unanalyzing rights system fails to warn about the hidden payload. Days later, an administrator with programming rights edits the page to fix a typo. Upon saving, XWiki reprocesses the page macros and executes the hidden Groovy code with the administrator's privileges, achieving remote code execution on the server. The attacker gains ability to read/modify database contents, access system files, or pivot to internal network. No user-visible warning occurred because the analyzer missed the obfuscated parameters. Attack complexity is low—standard wiki editing interface, no special tools required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
XWiki's macro rights analyzer introduced in version 15.9RC1 contains incomplete validation that allows attackers to hide malicious script macros (Groovy, Python) by exploiting non-lowercase parameter handling and unanalyzed macro parameters. An authenticated attacker with limited privileges can inject hidden malicious macros that execute when a higher-privileged user edits the page, enabling remote code execution. This vulnerability affects XWiki versions 15.9RC1 through 16.4.6, 16.10.0-16.10.2, and 16.x-17.0.0-rc1, with patches available in versions 16.4.7, 16.10.3, and 17.0.0.
RemediationAI
- priority: CRITICAL; action: Upgrade to patched versions; details: Apply security patches immediately: XWiki 16.4.7, 16.10.3, or 17.0.0 depending on installed branch. These versions include enhanced rights analyzers that properly validate macro parameters regardless of case, analyze parameters containing XWiki syntax, and inspect 'source' parameters in content/context macros.
- priority: HIGH; action: Access control hardening; details: Restrict edit permissions to trusted users only. Disable or restrict macro usage (especially script/Groovy/Python macros) for non-programming users through XWiki permission model. Review existing page history for suspicious macro usage patterns, particularly case-variant parameters or obfuscated source attributes.
- priority: MEDIUM; action: Detection and monitoring; details: Enable audit logging for page edits. Monitor for macros with mixed-case parameters (e.g., 'Script' vs 'script', 'SCRIPT') and 'source' parameters containing embedded syntax. Search wiki content for patterns: {{script...}}, {{groovy...}}, {{python...}} with non-standard casing or source parameter usage.
- priority: LOW; action: Temporary mitigation (if patching delayed); details: Disable dangerous macro types (Script, Groovy, Python) via XWiki configuration if not required for operations. This removes attack surface but may break dependent functionality. Requires configuration rebuild and wiki restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XWiki is a Java-based wiki platform that supports dynamic macro execution including dangerous macros (script, Groovy, Python) that require programming rights. The vulnerability stems from incomplete implementation of CWE-357 (Insufficient UI Warning of Dangerous Operations), specifically in the rights analyzer components introduced to warn users about macro execution risks. The root cause involves three distinct gaps: (1) parameter analysis limited to lowercase variants, allowing case-variant bypass; (2) failure to analyze macro parameters containing XWiki syntax such as information box titles; (3) insufficient analysis of 'source' parameters in content and context macros that can embed arbitrary XWiki syntax. The analyzer should prevent users without programming rights from silently injecting executable macros, but the incomplete checks allow obfuscation techniques to bypass these safeguards.
Know when Xwiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.
Executive ViewAI
CVE-2025-49582 is a critical remote code execution vulnerability in XWiki that allows attackers to bypass security warnings and inject malicious code into wiki pages. When users with administrative privileges subsequently edit these compromised pages, the hidden malicious macros execute with full programming rights, potentially compromising system integrity and sensitive data.
Apply vendor patch. If immediate patching is not feasible: (1) restrict wiki editing permissions to high-trust users only; (2) disable or restrict Groovy and Python macro execution via XWiki configuration; (3) implement WAF rules to monitor for suspicious macro parameters containing script syntax; (4) require administrative review and approval for all page edits; (5) isolate XWiki instances containing sensitive data from production networks until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in XWiki Privilege Escalation and Code Execution
View all 8XWiki Platform allows unauthenticated remote code execution through the SolrSearch endpoint, enabling guests to execute
XWiki Platform prior to specific patched versions contains a CVSS 10.0 remote code execution vulnerability through the u
XWiki is a generic wiki platform. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no aut
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated critical
XWiki Commons are technical libraries common to several other top level XWiki projects. Rated critical severity (CVSS 9.
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated critical
XWiki Platform is a generic wiki platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Unauthenticated HQL injection in the XWiki Platform REST search API lets remote attackers inject arbitrary Hibernate Que
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Rated critical
Exploit-DB