CVE-2025-46948: Adobe Experience Manager XSS Vulnerability

CVE-2025-46948 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to the affected page. The vulnerability affects both on-premises AEM deployments and AEM Cloud Service instances. Adobe released the fix in security bulletin APSB25-48.

Critical Impact
Attackers with low privileges can persist malicious scripts inside AEM form fields, hijack authenticated sessions, and pivot to higher-privileged accounts through the scoped browser context.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
AEM Forms component handling user-supplied field input

Discovery Timeline

2025-06-10 - CVE-2025-46948 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46948

Vulnerability Analysis

The flaw is a stored XSS condition in Adobe Experience Manager form fields. Server-side input handling does not adequately neutralize script constructs before persisting content. When the affected page renders, the browser interprets the stored payload as executable JavaScript.

Exploitation requires an attacker account with authoring or form-submission privileges. A separate victim must load the page containing the tainted field, and the session runs in the victim's browser context. Because the scope changes across security boundaries, script execution can affect resources beyond the vulnerable component. Impact includes session token theft, forced actions on behalf of the victim, and defacement of authenticated views.

Root Cause

The root cause is insufficient output encoding and input sanitization on form field values within AEM. The application persists attacker-controlled markup and later reflects it into the Document Object Model (DOM) without contextual escaping. Any script content stored in the field runs when the page renders.

Attack Vector

The attack vector is network-based and requires user interaction. An authenticated low-privileged attacker submits a form field containing a JavaScript payload. The payload is stored server-side by AEM. When an authenticated user, often an editor or administrator reviewing submissions, opens the page containing the field, the browser executes the injected script under that user's session.

No verified public proof-of-concept is available. See the Adobe Security Patch APSB25-48 advisory for vendor technical details.

Detection Methods for CVE-2025-46948

Indicators of Compromise

Form field values containing <script>, javascript:, onerror=, onload=, or encoded variants such as <script
Unexpected outbound HTTP requests from AEM author or publish nodes to attacker-controlled domains
Anomalous session cookie access patterns or session reuse from geographies inconsistent with the authenticated user
AEM audit log entries showing form submissions from low-privileged accounts followed by administrator page views

Detection Strategies

Inspect stored JCR content nodes under /content and /content/forms for HTML event handlers or <script> tags in text properties
Deploy a Content Security Policy (CSP) in report-only mode to surface script executions from unexpected inline sources
Correlate web access logs with form submission events to identify payload delivery followed by rendering by higher-privileged users
Run authenticated DAST scans against AEM form pages to enumerate reflected and stored injection sinks

Monitoring Recommendations

Alert on POST requests to AEM form endpoints containing script tokens or common XSS polyglots
Monitor Dispatcher and AEM error logs for parser exceptions triggered by malformed HTML in field submissions
Track new or modified content submissions by users with minimal privileges, especially outside business hours
Route AEM and web tier telemetry into an OCSF-normalized data lake to enable cross-source correlation of injection attempts and follow-on activity

How to Mitigate CVE-2025-46948

Immediate Actions Required

Apply the patches listed in Adobe security bulletin APSB25-48 to upgrade AEM beyond version 6.5.22
Audit existing form content for stored script payloads and purge tainted nodes before rendering to privileged users
Restrict form authoring permissions to the minimum set of trusted accounts and enforce multi-factor authentication
Rotate session tokens and API credentials for accounts that may have viewed compromised pages

Patch Information

Adobe published fixes under bulletin APSB25-48. Upgrade Adobe Experience Manager on-premises to a version later than 6.5.22, and confirm that AEM Cloud Service instances have received the corresponding service update. Full details are available in the Adobe Security Patch APSB25-48 bulletin.

Workarounds

Configure a strict Content Security Policy that blocks inline script execution on AEM author and publish tiers
Enable AEM Dispatcher filters to reject request payloads containing raw <script> tokens or known XSS patterns
Implement server-side sanitization using the AEM XSS API for any custom components that render form field values
Temporarily restrict access to affected form pages to network segments used by trusted operators until patching completes

bash

# Example Dispatcher filter snippet to block obvious script payloads in form submissions
/0100 { /type "deny" /method "POST" /url "*/content/forms/*" /query "*<script*" }
/0101 { /type "deny" /method "POST" /url "*/content/forms/*" /query "*javascript:*" }