CVE-2025-49586

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
xwiki	xwiki-platform	>= 7.2-milestone-2, < 16.4.7; >= 16.5.0-rc-1, < 16.10.3; >= 17.0.0-rc-1, < 17.0.0

References

https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-22719Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jun 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-495878.0XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.Notific CVE-2025-495888.7Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the se CVE-2025-495896.1PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 vers CVE-2025-495906.1CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent CVE-2025-495919.1CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially by CVE-2025-495925.4n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users c CVE-2025-495936.8Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2025-495949.2XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone CVE-2025-495954.9n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint whe CVE-2025-495969.4The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote CVE-2025-495973.9handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3,CVE-2025-495984.4conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script i