CVE-2025-58049

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-212 CWE-257

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-58056.5Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2025-580509.1The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read CVE-2025-580516.5Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user CVE-2025-580528.1Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attac CVE-2025-580539.8Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account CVE-2025-580545.4Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and render CVE-2025-580554.3Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Tit CVE-2025-580567.5Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and cl CVE-2025-580577.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2025-580585.3xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an CVE-2025-580599.1Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE,CVE-2025-58068.0Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduc