CVE-2025-32970: XWiki Open Redirect Vulnerability

CVE-2025-32970 Overview

CVE-2025-32970 is an open redirect vulnerability affecting XWiki, a generic wiki platform. The flaw resides in the HTML conversion request filter and allows attackers to craft URLs on a legitimate XWiki instance that redirect users to arbitrary external destinations. This weakness is classified under [CWE-601] (URL Redirection to Untrusted Site).

Affected versions include XWiki from 13.5-rc-1 through 15.10.12, from 16.0.0-rc-1 through 16.4.3, and from 16.5.0-rc-1 through 16.7.x. Patched releases are 15.10.13, 16.4.4, and 16.8.0.

Critical Impact
Attackers can abuse trusted XWiki URLs to redirect users to attacker-controlled sites, enabling phishing campaigns and credential harvesting against wiki users.

Affected Products

XWiki Platform 13.5-rc-1 through versions before 15.10.13
XWiki Platform 16.0.0-rc-1 through versions before 16.4.4
XWiki Platform 16.5.0-rc-1 through versions before 16.8.0

Discovery Timeline

2025-04-30 - CVE-2025-32970 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32970

Vulnerability Analysis

The vulnerability exists in XWiki's HTML conversion request filter, which processes redirect parameters without adequately validating the target URL. An attacker can construct a URL pointing to a legitimate XWiki instance that includes a redirect parameter referencing an arbitrary external domain. When a user clicks the crafted link, the XWiki server responds with a redirect to the attacker-controlled location.

Open redirects are commonly weaponized in phishing operations because the initial URL originates from a trusted domain. Victims see the legitimate XWiki hostname before being transparently forwarded to malicious infrastructure. This significantly increases the success rate of credential theft and drive-by download attacks.

User interaction is required for exploitation, as victims must click the crafted link. However, no authentication or elevated privileges are needed by the attacker to generate malicious URLs.

Root Cause

The root cause is missing URL validation in the request parameter converter that handles redirect targets during HTML conversion requests. The URLSecurityManager component did not expose a safe parsing method that validated whether a target URI belonged to a trusted domain before returning it to the redirect handler.

Attack Vector

Exploitation occurs over the network and requires social engineering. An attacker crafts a URL against a vulnerable XWiki host that embeds an untrusted destination in a redirect-controlling parameter. The victim receives the link through email, chat, or a malicious website and follows it to the trusted XWiki domain.

java

// Patch excerpt: URLSecurityManager.java introduces parseToSafeURI
// which validates redirect targets via isURITrusted before returning them.
{
    throw new SecurityException("Cannot guarantee safeness of " + serializedURI);
}

/**
 * Parse the given string to create a URI that is safe to use.
 * This method throws a {@link SecurityException} if the parsed URI is not safe to use according to
 * {@link #isURITrusted(URI)}. It might also throw a {@link URISyntaxException} if the parameter cannot be properly
 * parsed.
 *
 * @param serializedURI a string representing a URI that needs to be parsed.
 * @param requestHost the host the current request, this host will be added to the safe domains
 * @return a URI safe to use
 * @throws URISyntaxException if the given parameter cannot be properly parsed
 * @throws SecurityException if the parsed URI is not safe according to {@link #isURITrusted(URI)}
 * @since 16.8.0
 * @since 16.4.4
 * @since 15.10.13
 */
@Unstable
default URI parseToSafeURI(String serializedURI, String requestHost) throws URISyntaxException, SecurityException
{
    throw new SecurityException("Cannot guarantee that " + serializedURI + " is safe.");
}

Source: XWiki Security Patch Commit 6dab7909

Detection Methods for CVE-2025-32970

Indicators of Compromise

HTTP requests to XWiki HTML conversion endpoints containing redirect parameters that reference external hostnames not in the trusted domain list.
Referrer chains showing users leaving the XWiki host through HTTP 3xx responses to unfamiliar external domains.
Phishing reports from users who followed links that transited through the organization's XWiki domain.

Detection Strategies

Inspect web server access logs for XWiki HTML converter requests carrying URL-encoded external destinations in query parameters.
Enable trusted domain enforcement in XWiki and audit rejected requests logged by DefaultURLSecurityManager.
Correlate outbound redirect responses from the XWiki host with downstream DNS resolution to newly registered or low-reputation domains.

Monitoring Recommendations

Alert on 3xx responses from XWiki endpoints where the Location header points outside allowed corporate domains.
Track user click-through telemetry from email security gateways that resolve XWiki URLs to external destinations.
Review authentication logs for credential submissions occurring shortly after redirect events from the XWiki host.

How to Mitigate CVE-2025-32970

Immediate Actions Required

Upgrade XWiki to version 15.10.13, 16.4.4, or 16.8.0 depending on your current release branch.
Configure and enable the trusted domains feature in xwiki.properties to restrict redirect targets.
Notify wiki users about phishing risks and instruct them to verify the final destination of forwarded links.

Patch Information

The fix is delivered in XWiki 15.10.13, 16.4.4, and 16.8.0. It introduces parseToSafeURI in URLSecurityManager and validates redirect URLs in the request parameter converter before the HTML conversion filter honors them. Reference materials include the GitHub Security Advisory GHSA-pjhg-9wr9-rj96, the XWIKI-22487 JIRA issue, and the patch commit 6dab7909.

Workarounds

Restrict access to XWiki HTML conversion endpoints via reverse proxy rules that strip or validate redirect parameters.
Configure a web application firewall to block requests containing external URLs in redirect parameters targeting the HTML converter.
Enforce a strict trusted domains list in XWiki configuration to reject untrusted redirect targets.

bash

# xwiki.properties - enforce trusted domains for redirect handling
url.trustedDomains.enabled=true
url.trustedDomains=example.com,wiki.example.com