CVE-2025-47007: Adobe Experience Manager XSS Vulnerability

CVE-2025-47007 Overview

CVE-2025-47007 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses to a page containing the tainted field, the script executes in the victim's browser context. The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction and results in a scope change, allowing script execution against other users of the affected AEM instance.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of victim users interacting with compromised AEM pages.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service
AEM form components accepting unsanitized input

Discovery Timeline

2025-06-10 - CVE-2025-47007 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47007

Vulnerability Analysis

The vulnerability resides in how Adobe Experience Manager handles user-supplied data within form fields. AEM fails to properly neutralize input before rendering it back within served pages. An attacker with low privileges (for example, a content author) can persist malicious JavaScript payloads into stored form field values. When any user subsequently loads a page referencing that field, the browser executes the injected script.

Because the payload is stored server-side, exploitation does not require crafted request delivery to each victim. The scope change indicates the executed script can affect resources beyond the vulnerable component's security context, including other authenticated sessions on the same origin.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled data written to form field attributes or rendered HTML. AEM stores raw input in the JCR (Java Content Repository) and reflects it into HTML responses without applying contextual escaping appropriate for HTML, attribute, or JavaScript contexts.

Attack Vector

Exploitation proceeds over the network against an authenticated AEM instance. An attacker with content authoring or form editing privileges submits a payload containing HTML script tags or event handlers into a vulnerable form field. The payload is persisted in the repository. A victim, typically an administrator or another authenticated user, later navigates to the affected page and triggers script execution.

No verified public proof-of-concept code is available. Refer to the Adobe Security Update APSB25-48 for vendor technical details.

Detection Methods for CVE-2025-47007

Indicators of Compromise

Form field values in the JCR containing <script> tags, javascript: URIs, or DOM event handler attributes such as onerror, onload, or onmouseover.
Unexpected outbound HTTP requests from browsers loading AEM-rendered pages to attacker-controlled domains.
Authenticated AEM sessions performing anomalous administrative actions shortly after loading a content page.

Detection Strategies

Audit AEM content nodes and form component properties for HTML markup or script payloads stored in string fields.
Review AEM access logs for authoring activity that modifies form fields outside normal editorial workflows.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from stored content.

Monitoring Recommendations

Forward AEM error.log, request.log, and audit.log to a centralized SIEM for correlation with browser telemetry.
Alert on authoring API calls (/bin/wcmcommand, POST to /content/*) originating from accounts without expected authoring roles.
Monitor endpoint browser telemetry for JavaScript executions initiated from AEM-hosted pages that contact external hosts.

How to Mitigate CVE-2025-47007

Immediate Actions Required

Apply the Adobe security update referenced in APSB25-48 to upgrade AEM beyond version 6.5.22.
Review all form component content for previously stored payloads and remove malicious markup from affected nodes.
Restrict authoring privileges to trusted users and enforce least privilege on form authoring groups.

Patch Information

Adobe released the fix in security bulletin APSB25-48 on June 10, 2025. On-premises customers must install the AEM 6.5.23 Service Pack or later. AEM Cloud Service customers receive the patch automatically through the managed release channel. Verify installed versions using the AEM Web Console under /system/console/status-productinfo.

Workarounds

Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Place a web application firewall (WAF) in front of AEM with rules that block HTML tags and JavaScript URI schemes in form submissions.
Temporarily disable or restrict access to affected form components until the patch is applied.

bash

# Example CSP header to mitigate stored XSS execution
Content-Security-Policy: default-src 'self'; \
  script-src 'self' 'nonce-{RANDOM}'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'