CVE-2025-49581
BaseFortify
Publication date: 2025-06-13
Last updated on: 2025-09-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xwiki | xwiki | From 11.10.11 (inc) to 12.0 (exc) |
| xwiki | xwiki | From 12.6.3 (inc) to 12.7 (exc) |
| xwiki | xwiki | From 12.8 (inc) to 16.4.7 (exc) |
| xwiki | xwiki | From 16.5.0 (inc) to 16.10.3 (exc) |
| xwiki | xwiki | 17.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-270 | The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49581 is a high-severity remote code execution vulnerability in the XWiki platform. It allows any user with edit rights on a page to execute arbitrary code (such as Groovy, Python, or Velocity scripts) with programming rights by defining or overriding a wiki macro. The core issue is that if a wiki macro parameter allows wiki syntax, its default value is executed with the rights of the author of the document where the macro is used, which can be exploited to gain full access to the XWiki installation. This vulnerability was patched by changing the execution context so that default parameter values are executed with the rights of the macro's author instead of the document author. [1, 2]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing an attacker with low privileges and no user interaction to execute arbitrary code remotely on your XWiki installation. This leads to a complete compromise of confidentiality, integrity, and availability of the entire system, granting unauthorized full access and control over the XWiki platform. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade your XWiki installation to one of the patched versions: 16.4.7, 16.10.3, or 17.0.0. No known workarounds exist other than upgrading to these fixed versions. [1]