CVE-2025-46947: Adobe Experience Manager XSS Vulnerability

CVE-2025-46947 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit a page that renders the affected field. Adobe published the issue on June 10, 2025 in security bulletin APSB25-48. The flaw affects both on-premise AEM installations and AEM Cloud Service deployments.

Critical Impact
Authenticated attackers can persist JavaScript into AEM form fields and execute it in the sessions of users who load the affected content, enabling session theft, UI defacement, or client-side redirection.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Downstream AEM Forms components that render user-supplied field content

Discovery Timeline

2025-06-10 - Adobe publishes security bulletin APSB25-48
2025-06-10 - CVE-2025-46947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46947

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. AEM stores attacker-controlled input without adequate output encoding, then reflects that content in a rendered page. When a victim loads the page, the browser interprets the injected <script> payload as executable code inside the AEM origin.

Exploitation requires low privileges and user interaction. The attacker must hold an authenticated AEM account with permission to submit or edit form content. A victim must then browse to the page containing the poisoned field. Because the payload runs under the AEM domain, it inherits the victim's session context, which can include content author or administrator privileges.

The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself, such as adjacent AEM administrative interfaces loaded in the same origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM accepts user-supplied form field values and later renders them in HTML context without sufficient sanitization or contextual output encoding. Adobe has not published low-level technical details of the vulnerable component in the public advisory.

Attack Vector

An authenticated attacker with content submission rights writes a JavaScript payload into a vulnerable form field. AEM persists the payload in the content repository. When a legitimate user, often a content author or reviewer, navigates to a page that displays the field, the browser executes the stored script. Typical outcomes include session token exfiltration, forced actions performed as the victim, and pivoting into AEM administrative workflows.

No verified proof-of-concept code is publicly available. Refer to the Adobe Experience Manager Security Advisory for vendor guidance.

Detection Methods for CVE-2025-46947

Indicators of Compromise

Form field values in the AEM JCR repository containing <script>, javascript:, onerror=, or onload= tokens.
Unexpected outbound HTTP requests from browsers loading AEM author or publish pages to unfamiliar domains.
Author or administrator sessions performing actions they did not initiate, such as user creation or permission changes.

Detection Strategies

Query the JCR repository for stored node properties containing HTML tags, event handlers, or encoded script fragments in form-related nodes.
Enable and review AEM Dispatcher and access logs for anomalous POST requests writing payloads into form components.
Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from AEM-rendered pages.

Monitoring Recommendations

Alert on authenticated form submissions containing HTML control characters that bypass expected input schemas.
Correlate content author login events with subsequent privileged administrative actions performed from the same session.
Monitor browser telemetry from workstations used by AEM authors for unexpected script execution on AEM domains.

How to Mitigate CVE-2025-46947

Immediate Actions Required

Upgrade on-premise AEM to the fixed release identified in Adobe bulletin APSB25-48, moving beyond version 6.5.22.
Confirm AEM as a Cloud Service tenants are running the current release, which Adobe patches centrally.
Audit existing form field content in the repository for previously injected payloads before restoring services.
Rotate session tokens and credentials for any accounts that may have loaded a poisoned page.

Patch Information

Adobe addressed the vulnerability in the update described in Adobe Security Bulletin APSB25-48. Apply the AEM 6.5 Service Pack referenced in the bulletin, and validate the fix on staging before production rollout.

Workarounds

Restrict form submission and content authoring permissions to the minimum set of trusted users.
Deploy a strict Content Security Policy that disallows inline scripts on AEM-rendered pages.
Add Dispatcher or Web Application Firewall rules that block form field payloads containing script tags or JavaScript event handlers.
Sanitize existing repository content and remove any stored HTML from user-controlled form fields.

bash

# Example Dispatcher filter rule to block script tokens in form parameters
/0100 { /type "deny" /method "POST" /url "*/content/forms/*" /query "*<script*" }
/0101 { /type "deny" /method "POST" /url "*/content/forms/*" /query "*javascript:*" }