CVE-2025-23025: XWiki Platform XSS Vulnerability

CVE-2025-23025 Overview

CVE-2025-23025 is a privilege escalation vulnerability in the XWiki Platform Realtime WYSIWYG Editor extension. A user holding only edit rights can join a realtime editing session containing users with script or programming rights. The attacker inserts script rendering macros that execute under the higher-privileged users' permissions. The injected scripts can then be used to acquire additional access rights across the wiki. The flaw is tracked as [CWE-862: Missing Authorization] and affects the org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui component. XWiki has patched the issue in versions 15.10.2, 16.4.1, and 16.6.0-rc-1.

Critical Impact
Low-privileged authenticated users can execute arbitrary scripts in the context of administrators or programming-rights users, leading to full wiki compromise.

Affected Products

XWiki Platform versions prior to 15.10.2
XWiki Platform 16.x versions prior to 16.4.1
XWiki Platform 16.5.0 and 16.6.0 release candidates

Discovery Timeline

2025-01-14 - CVE-2025-23025 published to NVD
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2025-23025

Vulnerability Analysis

XWiki is a Java-based enterprise wiki platform that supports collaborative editing through its Realtime WYSIWYG Editor extension. The extension uses a CKEditor plugin called xwiki-realtime to synchronize document edits across multiple authors. In affected releases, the realtime session does not enforce rights checks consistent with the highest-privileged participant in the session.

When a low-privileged author joins a realtime editing session, the content they submit is later rendered in the context of every participant. If any participant holds script or programming rights, embedded script macros execute with those elevated rights. The attacker effectively borrows the privilege level of the most trusted user present.

This design treats the realtime channel as trusted content originating from the local editor rather than as input that must be authorized against each renderer's rights. The result is a confused-deputy condition classified under [CWE-862].

Root Cause

The Realtime WYSIWYG Editor does not validate that a content author possesses the rights required by the macros they insert. XWiki's macro execution model normally requires the page author to hold script or programming rights before script macros run. The realtime channel bypasses this check because the edits are merged into a document owned by the higher-privileged user.

Attack Vector

The attacker requires only an authenticated account with edit rights on a page that is being edited concurrently by a privileged user. The attacker joins the realtime session and inserts a script rendering macro such as a Groovy or Velocity block. When the privileged participant's browser renders the document, the macro executes under that user's rights and can call XWiki APIs to grant administrative privileges, exfiltrate data, or modify access controls.

The vulnerability is described in detail in the GitHub Security Advisory GHSA-rmm7-r7wr-xpfg and tracked in the XWiki Jira issue XWIKI-21949. No public proof-of-concept code has been released.

Detection Methods for CVE-2025-23025

Indicators of Compromise

Unexpected appearance of script, Groovy, or Velocity macros in pages edited collaboratively through the realtime editor.
New users granted administrative or programming rights without a corresponding audit trail entry from an administrator.
Realtime editing sessions that include both unprivileged edit-only users and users with script or programming rights.

Detection Strategies

Audit page revisions for insertion of {{groovy}}, {{velocity}}, or {{script}} macros by authors lacking the corresponding rights.
Review XWiki access logs for WebSocket connections to the realtime channel originating from low-privileged accounts.
Compare the macro content of recent revisions against historical baselines for documents edited by administrators.

Monitoring Recommendations

Enable verbose audit logging on the XWiki rights service and forward events to a centralized log platform for correlation.
Alert on any modification to XWikiPreferences or group membership documents that occurs immediately after a realtime editing session.
Track installation status of the org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui extension across all XWiki instances.

How to Mitigate CVE-2025-23025

Immediate Actions Required

Upgrade XWiki to version 15.10.2, 16.4.1, 16.6.0-rc-1, or later as published by the XWiki project.
If an immediate upgrade is not possible, disable the xwiki-realtime CKEditor plugin from the WYSIWYG editor administration section.
Review accounts that hold script or programming rights and confirm no unauthorized privilege grants were made.
Inventory pages that contain script macros authored by users without script rights and revert suspicious revisions.

Patch Information

XWiki released fixes in versions 15.10.2, 16.4.1, and 16.6.0-rc-1. The patches enforce rights validation on content submitted through the realtime channel so that script macros inserted by an unprivileged participant are not executed with the privileges of other session members. See the GitHub Security Advisory GHSA-rmm7-r7wr-xpfg for the full patch details.

Workarounds

Disable the realtime WYSIWYG editing feature by turning off the xwiki-realtime CKEditor plugin in the WYSIWYG editor administration section, as documented in the XWiki CKEditor Integration Guide.
Uninstall the Realtime WYSIWYG Editor extension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui) from the XWiki extension manager.
Restrict edit rights on pages owned by administrators or other users with script or programming access until the upgrade is applied.

bash

# Configuration example: disable the realtime CKEditor plugin
# Navigate to: Administration > Editing > WYSIWYG Editor
# In the "Disabled Plugins" field, append:
xwiki-realtime

# Or remove the extension via the XWiki extension manager UI:
# Administration > Extensions > Installed Extensions
# Locate: org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui
# Click: Uninstall