CVE-2025-32430: XWiki Platform XSS Vulnerability

CVE-2025-32430 Overview

CVE-2025-32430 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the XWiki Platform, a generic wiki platform providing runtime services for applications. Two templates, extension.vm and job_status_json.vm, fail to properly escape user-controlled input. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser session when visited. This allows attackers to perform actions using the victim's permissions, including administrative operations if the victim holds elevated privileges. The vulnerability affects XWiki versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5, and 17.0.0-rc-1 through 17.2.2.

Critical Impact
Attackers who trick authenticated XWiki users into visiting crafted URLs can execute arbitrary JavaScript, hijack sessions, and perform privileged wiki actions.

Affected Products

XWiki Platform versions 4.2-milestone-3 through 16.4.7
XWiki Platform versions 16.5.0-rc-1 through 16.10.5
XWiki Platform versions 17.0.0-rc-1 through 17.2.2

Discovery Timeline

2025-08-06 - CVE-2025-32430 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32430

Vulnerability Analysis

The vulnerability resides in two Velocity templates shipped with the XWiki web module: extension.vm and job_status_json.vm. Both templates render values derived from request parameters into HTML or JSON responses without applying proper output escaping. An attacker who controls a URL parameter can inject JavaScript that the server reflects back into the rendered page. When a victim opens the crafted link, the browser executes the injected script in the origin of the XWiki instance.

Execution occurs in the context of the authenticated victim's session. The attacker inherits the victim's XWiki permissions for the duration of the script, enabling session-scoped actions such as creating pages, modifying content, or invoking administrator endpoints if the victim is privileged. Exploitation requires user interaction, as noted by the UI:P component of the CVSS 4.0 vector.

Root Cause

The extension.vm template emits a $name variable directly into the HTML output without invoking XWiki's XML escaping utilities. When $name originates from attacker-controlled request data, the raw value is written into the DOM. A parallel issue exists in job_status_json.vm, where JSON response fields lack escaping suitable for their embedding context.

Attack Vector

Exploitation occurs over the network and requires no privileges. The attacker delivers a malicious URL to an XWiki user through phishing, chat, or a compromised referrer. When the victim visits the URL, the vulnerable template reflects the payload into the response, and the browser executes it.

The upstream patch replaces the direct output of $name with an escaped call using XWiki's escapetool:

text

 #set ($name = $name.substring($mathtool.add($name.indexOf(':'), 1)))
 #end
 #end
-${name}##
+${escapetool.xml($name)}##
 #end
 
 #macro (displayExtensionActionButtons $extension $readOnly)

Source: XWiki commit e5926a9

Detection Methods for CVE-2025-32430

Indicators of Compromise

Web server access logs showing requests to extension.vm or job_status_json.vm endpoints with URL parameters containing <script>, javascript:, or HTML event handler substrings such as onerror= and onload=.
Unexpected outbound requests from XWiki users' browsers to attacker-controlled domains immediately after loading an XWiki page.
Wiki audit logs showing privileged actions performed by users who did not knowingly initiate them.

Detection Strategies

Deploy web application firewall rules that inspect query strings targeting XWiki extension manager and job status URLs for HTML tags and script keywords.
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts blocked by the browser.
Correlate referrer headers on XWiki sessions to identify users arriving from external URLs immediately before privileged actions.

Monitoring Recommendations

Ingest XWiki application logs and reverse proxy logs into a centralized platform and alert on suspicious parameter patterns targeting the affected templates.
Monitor for spikes in 200-OK responses served from extension-related endpoints with unusually long query strings.
Track and review administrator-level wiki modifications made shortly after users click external links.

How to Mitigate CVE-2025-32430

Immediate Actions Required

Upgrade XWiki to a fixed release: 16.4.8, 16.10.6, or 17.3.0-rc-1 or later.
Inventory all XWiki instances and identify any exposed to untrusted users or the public internet.
Educate wiki users to avoid clicking XWiki URLs received from untrusted sources until patching is complete.

Patch Information

The fix is delivered in XWiki Platform versions 16.4.8, 16.10.6, and 17.3.0-rc-1. The remediation applies escapetool.xml() to reflected variables in extension.vm and adjusts escaping in job_status_json.vm. Refer to the XWiki GHSA-m9x4-w7p9-mxhx advisory and JIRA issue XWIKI-23096 for full details.

Workarounds

Manually patch the deployed WAR file by applying the same escaping changes as the upstream commit to extension.vm and job_status_json.vm.
Restrict access to the XWiki extension manager and job status endpoints via reverse proxy rules until patched.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected payloads.

bash

# Example nginx rule to block obvious XSS payloads targeting affected templates
location ~* /(extension|job_status_json)\.vm {
    if ($args ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://xwiki_backend;
}