What is the CVSS score of EUVD-2025-18298?

EUVD-2025-18298 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Xwiki are affected by EUVD-2025-18298?

CVE-2025-49583 is a low-severity vulnerability in XWiki (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for EUVD-2025-18298?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18298. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-18298?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Xwiki EUVD-2025-18298

| CVE-2025-49583 LOW

Privilege Context Switching Error (CWE-270)

2025-06-13 security-advisories@github.com

GHSA-ff6v-w58f-v97w

Information Disclosure Xwiki

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18298

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

Patch released

Mar 14, 2026 - 21:34 nvd

Patch available

PoC Detected

Sep 03, 2025 - 17:50 vuln.today

Public exploit code

CVE Published

Jun 13, 2025 - 17:15 nvd

LOW 3.5

DescriptionGitHub Advisory

XWiki is a generic wiki platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationEmailRendererClass object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as while these templates allow Velocity code, the existing generic analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., with phishing links to other users or to hide notifications about other attacks. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.