xwiki-platform up to 16.4.6/16.10.2 lowercase protection mechanism

Summaryinfo

A vulnerability was found in xwiki-platform up to 16.4.6/16.10.2. It has been classified as critical. Affected by this vulnerability is an unknown functionality. This manipulation of the argument lowercase causes protection mechanism. The identification of this vulnerability is CVE-2025-49582. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in xwiki-platform up to 16.4.6/16.10.2. Affected by this vulnerability is an unknown code block. The manipulation of the argument lowercase with an unknown input leads to a protection mechanism vulnerability. The CWE definition for the vulnerability is CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-49582 since 06/06/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 16.4.7, 16.10.3 or 17.0.0 eliminates this vulnerability. Applying the patch 0a705e8e253cb871b804e25c53b2bde879c886bd is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18293). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 16.4.0
• 16.4.1
• 16.4.2
• 16.4.3
• 16.4.4
• 16.4.5
• 16.4.6
• 16.10.0
• 16.10.1
• 16.10.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion