CVE-2025-49586

HIGH

XWiki allows remote code execution through preview of XClass changes in AWM editor

Published June 13, 2025Updated June 13, 2025Source: osv

Summary

### Impact Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. The detailed reproduction steps can be found in the [original bug report](https://jira.xwiki.org/browse/XWIKI-22719). ### Patches This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3. ### Workarounds Restricting edit rights on all existing App Within Minutes applications to trusted users mitigates at least the PoC exploit, but we can't exclude that there are other ways to exploit this vulnerability.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 16.10.3 or later

<!-- Update pom.xml dependency version to 16.10.3 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 17.0.0 or later

<!-- Update pom.xml dependency version to 17.0.0 for org.xwiki.platform:xwiki-platform-oldcore -->

Maven

Update org.xwiki.platform:xwiki-platform-oldcore to 16.4.7 or later

<!-- Update pom.xml dependency version to 16.4.7 for org.xwiki.platform:xwiki-platform-oldcore -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	16.10.3
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	17.0.0
org.xwiki.platform:xwiki-platform-oldcore	maven	All versions	16.4.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-49586?: XWiki allows remote code execution through preview of XClass changes in AWM editor This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2025-49586?: CVE-2025-49586 affects org.xwiki.platform:xwiki-platform-oldcore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-49586 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-jp4x-w9cj-97q7

Related CVEs

CVE-2023-26474
CRITICAL
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CVE-2023-36468
CRITICAL
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CVE-2024-31987
CRITICAL
XWiki Platform remote code execution from account via custom skins support
CVE-2023-29526
CRITICAL
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CVE-2023-46242
CRITICAL
XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
CVE-2024-37899
CRITICAL
XWiki Platform allows remote code execution from user account
CVE-2024-56158
CRITICAL
XWiki allows SQL injection in query endpoint of REST API with Oracle
CVE-2026-40104
MEDIUM
XWiki's REST APIs can list all pages/spaces, leading to unavailability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies