CVE-2025-46930: Adobe Experience Manager XSS Vulnerability

CVE-2025-46930 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the affected field. Adobe published the fix in security advisory APSB25-48 on June 10, 2025.

The vulnerability affects both on-premise AEM installations and the AEM Cloud Service. Exploitation requires user interaction and low privileges, and the scope change means the injected script can affect resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can persist JavaScript in form fields to hijack sessions, steal credentials, or perform actions in the context of any user who views the injected content.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
AEM Forms components handling user-controlled field input

Discovery Timeline

2025-06-10 - Adobe releases security patch and publishes advisory APSB25-48
2025-06-10 - CVE-2025-46930 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46930

Vulnerability Analysis

The flaw is a stored Cross-Site Scripting weakness in Adobe Experience Manager form field handling. AEM fails to properly sanitize or encode attacker-controlled input written into form fields before persisting it and rendering it back to other users. When a victim navigates to a page containing the tainted field, the browser executes the attacker's JavaScript in the origin of the AEM site.

Because the payload is stored server-side, exploitation does not require crafted links or phishing. Any authenticated user who visits the affected page triggers the payload. The scope change indicates the injected script can act on data outside the vulnerable component's security domain, expanding the blast radius across the AEM tenant.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM accepts markup and script content in form field values and reflects it into the DOM without contextual output encoding. The application trusts input from users with low privileges, such as authors or contributors, without applying the same output-side controls used elsewhere in the platform.

Attack Vector

Exploitation is network-based and requires an authenticated account with low privileges. The attacker submits a crafted payload into a vulnerable form field within the AEM authoring or content interface. AEM stores the payload and later serves it to any user who views the page containing the field. User interaction is required — the victim must load the affected page — after which the script runs in the victim's session.

Typical impact includes session token theft, unauthorized content modifications, redirection to attacker-controlled sites, and abuse of higher-privileged users' permissions when they view the poisoned content.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the Adobe Security Advisory APSB25-48 for vendor-supplied technical details.

Detection Methods for CVE-2025-46930

Indicators of Compromise

Form field values in the AEM content repository containing <script>, javascript:, or event handler attributes such as onerror= and onload=.
Unexpected outbound requests from author or publish instances to unknown domains, suggesting exfiltration by injected scripts.
Content modifications by low-privileged author accounts to fields that normally accept only plain text.

Detection Strategies

Query the JCR repository for form component nodes with property values matching HTML tags or JavaScript URI schemes.
Review AEM access.log and request.log for POST requests to form authoring endpoints containing encoded script payloads.
Enforce Content Security Policy reporting to surface inline script violations originating from AEM-rendered pages.

Monitoring Recommendations

Monitor authoring activity from low-privileged accounts for anomalous edits to shared or high-traffic pages.
Alert on browser console errors and CSP violation reports referencing AEM-hosted pages after the patch window.
Track any changes to Sling servlet configurations or dispatcher rules that could weaken output filtering.

How to Mitigate CVE-2025-46930

Immediate Actions Required

Upgrade AEM on-premise installations to version 6.5.23 or later as specified in APSB25-48.
Confirm AEM as a Cloud Service tenants are running a build that includes the Adobe-supplied fix.
Audit existing form field content for stored payloads and remove any injected script fragments before restoring services.
Rotate session tokens and credentials for accounts that may have loaded compromised pages.

Patch Information

Adobe published the fix in Adobe Security Advisory APSB25-48 on June 10, 2025. The advisory addresses multiple AEM issues, including CVE-2025-46930. Apply the vendor-supplied service pack for AEM 6.5.x and confirm the Cloud Service release notes list the fix.

Workarounds

Restrict the set of accounts with authoring or form-editing permissions until the patch is deployed.
Deploy a strict Content Security Policy that blocks inline scripts and untrusted script sources on AEM-served pages.
Configure the AEM Dispatcher and reverse proxy to strip or reject request bodies containing script tags in form field parameters.
Enable AEM's XSS Protection API on custom components that render user-controlled field values.

bash

# Example CSP header to reduce stored XSS impact on AEM responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report