CVE-2025-49587 Details
Description
XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.
A cross-site scripting (XSS) vulnerability exists in XWiki versions 15.9-rc-1 prior to 15.10.16, 16.0.0-rc-1 prior to 16.4.7, and 16.5.0-rc-1 prior to 16.10.2. The issue arises when a user without script rights creates a document containing an 'XWiki.Notifications.Code.NotificationDisplayerClass' object. If an admin later edits and saves that document, any potentially malicious content in the object is rendered as raw HTML, facilitating XSS attacks. Although the notification displayer processes Velocity code, an existing generic analyzer alerts admins before editing Velocity content. However, prior to XWiki 15.9, there were no such warnings for documents with hazardous properties, leaving a gap in security.
Users can update to XWiki versions 15.10.16, 16.4.7, or 16.10.2, where this vulnerability has been patched. Instructions for updating XWiki can be found in the XWiki documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252d | [email protected] | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7 | [email protected] | Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-22470 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-357 | Insufficient UI Warning of Dangerous Operations | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xwiki xwiki | >= 15.9, < 15.10.16 >= 16.0.0, < 16.4.7 >= 16.5.0, < 16.10.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2025 | Initial Analysis | [email protected] |
| Jun 13, 2025 | New CVE Received | [email protected] |