xwiki-platform up to 15.10.15/16.4.6/16.10.1 insufficient warning

Summaryinfo

A vulnerability has been found in xwiki-platform up to 15.10.15/16.4.6/16.10.1 and classified as critical. This issue affects some unknown processing. Performing a manipulation results in insufficient warning. This vulnerability is known as CVE-2025-49585. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in xwiki-platform up to 15.10.15/16.4.6/16.10.1. This affects an unknown part. The manipulation with an unknown input leads to a insufficient warning vulnerability. CWE is classifying the issue as CWE-357. The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior warning. In particular, this concerns custom display code, the script of computed properties and queries in database list properties. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-49585 since 06/06/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 15.10.16, 16.4.7 or 16.10.2 eliminates this vulnerability. Applying the patch 385bde985cdb61ebf315d30c0b144b6d2e2c2d45 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18299). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 15.10.0
• 15.10.1
• 15.10.2
• 15.10.3
• 15.10.4
• 15.10.5
• 15.10.6
• 15.10.7
• 15.10.8
• 15.10.9
• 15.10.10
• 15.10.11
• 15.10.12
• 15.10.13
• 15.10.14
• 15.10.15
• 16.4.0
• 16.4.1
• 16.4.2
• 16.4.3
• 16.4.4
• 16.4.5
• 16.4.6
• 16.10.0
• 16.10.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion