CVE-2025-46952: Adobe Experience Manager XSS Vulnerability

CVE-2025-46952 Overview

CVE-2025-46952 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The flaw allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields. When another user browses a page containing the tainted field, the script executes in that user's browser session.

The vulnerability is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. Adobe published corresponding fixes in security advisory APSB25-48.

Critical Impact
Authenticated attackers can persist malicious JavaScript that executes against any user viewing the affected page, enabling session token theft, credential harvesting, and unauthorized actions in the AEM author or publish environment.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager AEM Cloud Service (affected releases per APSB25-48)
AEM form component rendering pipeline

Discovery Timeline

2025-06-10 - CVE-2025-46952 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46952

Vulnerability Analysis

The vulnerability resides in how Adobe Experience Manager handles user-supplied content submitted through form fields. AEM stores the field values in the JCR repository and later renders them into HTML responses without adequate output encoding. A low-privileged user with permission to author or submit form content can supply JavaScript payloads that persist server-side.

When a victim loads the affected page, the browser parses the injected markup and executes the attacker's script under the origin of the AEM instance. Because AEM is commonly deployed as an internet-facing content platform, the executed script inherits access to session cookies, CSRF tokens, and any DOM data available to the victim.

The impact is limited to confidentiality and integrity in a single scope, with no direct availability impact. However, in author environments, script execution against an administrator can lead to account takeover and lateral compromise of published content.

Root Cause

The root cause is missing or insufficient output sanitization of form field values before they are reflected into the rendered page. AEM's rendering layer trusts stored values and emits them into the HTML context without encoding characters such as <, >, and ". This violates the standard XSS defense of contextual output encoding.

Attack Vector

An attacker authenticates to AEM using an account with content-authoring or form-submission privileges. The attacker injects a payload similar to a <script> tag or an event-handler attribute into a vulnerable form field. AEM persists the value in the repository.

When a legitimate user, including administrators reviewing submissions, opens the containing page, the browser executes the stored payload. No user interaction beyond browsing the page is required. Adobe's advisory APSB25-48 documents the affected components and fixed versions.

No verified public proof-of-concept code is available for CVE-2025-46952.
Refer to Adobe Security Advisory APSB25-48 for authoritative technical details.

Detection Methods for CVE-2025-46952

Indicators of Compromise

Form field values in the JCR repository containing <script>, javascript:, or DOM event-handler attributes such as onerror= and onload=.
AEM access.log entries showing POST requests to form-submission endpoints with encoded angle brackets or script keywords in parameter values.
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting AEM-hosted pages.
Session anomalies for privileged AEM authors, including logins from new IP addresses shortly after browsing submitted content.

Detection Strategies

Search the JCR repository for stored properties matching common XSS token patterns using JCR-SQL2 queries against form component nodes.
Deploy a Web Application Firewall (WAF) rule set that inspects AEM form POST bodies for script injection signatures.
Correlate authentication events for AEM author accounts with subsequent content-modification actions to identify suspicious authoring behavior.

Monitoring Recommendations

Enable verbose logging on the AEM Dispatcher and forward logs to a centralized SIEM for retention and analysis.
Alert on Content Security Policy (CSP) violation reports originating from AEM-hosted pages.
Review access grants periodically to ensure the principle of least privilege for content authors and form submitters.

How to Mitigate CVE-2025-46952

Immediate Actions Required

Upgrade Adobe Experience Manager to the fixed version listed in Adobe Security Advisory APSB25-48.
Audit user accounts with authoring or form-submission privileges and remove unnecessary access.
Inspect existing form component content for stored script payloads and remediate identified entries.

Patch Information

Adobe released fixes for CVE-2025-46952 as part of the AEM 6.5 Service Pack cycle documented in Adobe Security Advisory APSB25-48. AEM Cloud Service customers receive the fix through Adobe's managed release channel. Verify the deployed version reports as later than 6.5.22 for on-premises installations.

Workarounds

Deploy a WAF policy that blocks HTML and JavaScript metacharacters in AEM form field submissions until patching is complete.
Enforce a strict Content Security Policy on AEM-served pages to limit inline script execution and restrict script sources.
Restrict access to author instances to VPN or bastion networks to reduce the attack surface for low-privileged accounts.

bash

# Example CSP header to restrict inline script execution on AEM pages
# Configure in the AEM Dispatcher or upstream reverse proxy
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'