xwiki xwiki-platform up to 15.10.7/16.1.x REQUIRED Rights Analysis escape output

Summaryinfo

A vulnerability classified as critical has been found in xwiki xwiki-platform up to 15.10.7/16.1.x. This affects an unknown function of the component REQUIRED Rights Analysis. This manipulation causes escape output. This vulnerability is registered as CVE-2025-32974. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in xwiki xwiki-platform up to 15.10.7/16.1.x. It has been declared as critical. Affected by this vulnerability is some unknown processing of the component REQUIRED Rights Analysis. The manipulation with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-32974 since 04/14/2025. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 15.10.8 or 16.2.0 eliminates this vulnerability. Applying the patch 153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• xwiki

Name

• xwiki-platform

Version

• 15.10.0
• 15.10.1
• 15.10.2
• 15.10.3
• 15.10.4
• 15.10.5
• 15.10.6
• 15.10.7
• 16.0
• 16.1

License

• open-source

Website

• Product: https://github.com/xwiki/xwiki-platform/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion