xwiki-platform up to 15.10.15/16.4.6/16.10.1 insufficient warning

Summaryinfo

A vulnerability categorized as critical has been discovered in xwiki-platform up to 15.10.15/16.4.6/16.10.1. This impacts an unknown function of the component XWiki.Notifications.Code.NotificationDisplayerClass. Such manipulation leads to insufficient warning. This vulnerability is referenced as CVE-2025-49587. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in xwiki-platform up to 15.10.15/16.4.6/16.10.1 and classified as critical. Affected by this issue is an unknown functionality of the component XWiki.Notifications.Code.NotificationDisplayerClass. The manipulation with an unknown input leads to a insufficient warning vulnerability. Using CWE to declare the problem leads to CWE-357. The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention. Impacted is confidentiality, integrity, and availability. CVE summarizes:

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-49587 since 06/06/2025. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 15.10.16, 16.4.7 or 16.10.2 eliminates this vulnerability. Applying the patch 55c5d568c4dc4619f37397d00d14dcdeab9c252d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18296). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• xwiki-platform

Version

• 15.10.0
• 15.10.1
• 15.10.2
• 15.10.3
• 15.10.4
• 15.10.5
• 15.10.6
• 15.10.7
• 15.10.8
• 15.10.9
• 15.10.10
• 15.10.11
• 15.10.12
• 15.10.13
• 15.10.14
• 15.10.15
• 16.4.0
• 16.4.1
• 16.4.2
• 16.4.3
• 16.4.4
• 16.4.5
• 16.4.6
• 16.10.0
• 16.10.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion