CVE-2025-49580 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.

Reserved 2025-06-06 | Published 2025-06-13 | Updated 2025-06-13 | Assigner GitHub_M

HIGH: 8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-266: Incorrect Privilege Assignment

Product status

>= 17.0.0-rc-1, < 17.1.0-rc-1

affected

>= 16.5.0-rc-1, < 16.10.4

affected

>= 8.2, < 16.4.7

affected

>= 7.4.5, < 8.0-milestone-1

affected

References

github.com/...atform/security/advisories/GHSA-jm43-hrq7-r7w6

github.com/...ommit/ab209acd780da69a4c5ff77ff011efd698273cec

jira.xwiki.org/browse/XWIKI-22836

cve.org (CVE-2025-49580)

nvd.nist.gov (CVE-2025-49580)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-49580

Support options

Helpdesk Chat, Email, Knowledgebase