CVE-2025-58049 Details
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.
A vulnerability exists in XWiki Platform versions 14.4.2 prior to 16.4.8, 16.5.0-rc-1 prior to 16.10.7, and 17.0.0-rc-1 prior to 17.4.0-rc-1. The issue arises because PDF export jobs store sensitive cookies, including encrypted usernames and passwords, unencrypted in job statuses. This data is saved in the permanent directory after the export job is completed, creating a security risk as it effectively reveals plain text passwords. The vulnerability was introduced by a feature that added cookie storage for PDF exports performed by a headless browser in a Docker container.
Users can upgrade to XWiki versions 16.4.8, 16.10.7, or 17.4.0-rc-1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 | [email protected] | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 | [email protected] | Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-23151 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | [email protected] |
| CWE-257 | Storing Passwords in a Recoverable Format | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xwiki xwiki | >= 14.4.2, < 16.4.8 >= 16.5.0, < 16.10.7 >= 17.0.0, <= 17.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2025 | Initial Analysis | [email protected] |
| Aug 28, 2025 | New CVE Received | [email protected] |