CVE-2025-47011: Adobe Experience Manager XSS Vulnerability

CVE-2025-47011 Overview

CVE-2025-47011 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The flaw allows a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim browses to a page containing the affected field, the injected script executes in their browser context. Adobe classifies this as CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction and results in a scope change, meaning the impact extends beyond the vulnerable component to affect the victim's browser session.

Critical Impact
Authenticated attackers can persist malicious scripts in AEM form fields, leading to session compromise and unauthorized actions performed in the victim's browser context.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service
AEM Forms component containing vulnerable input fields

Discovery Timeline

2025-06-10 - CVE-2025-47011 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47011

Vulnerability Analysis

The vulnerability resides in Adobe Experience Manager's handling of user-supplied content within form fields. AEM fails to properly neutralize input before rendering it back to users viewing the affected pages. This allows an authenticated attacker with low privileges to store JavaScript payloads that later execute when other users, including administrators, access the compromised content.

Because the payload persists server-side, every visitor to the affected page becomes a potential victim. The scope change reflected in the CVSS vector indicates that scripts execute in the browser context of the victim rather than the vulnerable AEM component itself. This enables session token theft, forced actions on behalf of the victim, and pivoting to further attacks within the AEM administrative interface.

Root Cause

The root cause is missing or insufficient output encoding on form field values rendered within AEM-generated pages. When user input is stored and later reflected without HTML entity encoding or context-appropriate sanitization, HTML and script tags supplied by the attacker are interpreted by the browser. This is a classic [CWE-79] pattern where trust boundaries between authenticated content authors and content consumers are not enforced by proper escaping.

Attack Vector

An attacker with authenticated access to AEM authoring or form-editing capabilities submits a crafted payload into a vulnerable form field. The payload is stored in the AEM repository and served to subsequent visitors. User interaction, such as loading the affected page or interacting with the form, triggers execution. The attack is network-reachable and requires no elevated privileges beyond standard content contributor access.

Because no verified proof-of-concept has been published, technical exploitation details are limited to the vendor advisory. See the Adobe Experience Manager Security Advisory APSB25-48 for additional context.

Detection Methods for CVE-2025-47011

Indicators of Compromise

Form field values in the AEM JCR repository containing <script>, javascript:, or HTML event handler attributes such as onerror and onload
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after accessing AEM authoring pages
Anomalous session token usage or administrative actions originating from IPs that differ from the legitimate admin's location

Detection Strategies

Review AEM audit logs for form modifications made by low-privileged accounts, focusing on fields that render HTML in downstream pages
Query the JCR repository for stored property values containing script tags or JavaScript URI schemes
Deploy Content Security Policy (CSP) reporting to surface script execution violations from AEM-served pages

Monitoring Recommendations

Monitor HTTP responses from AEM instances for unescaped user-supplied content in form field rendering
Alert on privilege changes, session anomalies, or bulk content edits performed shortly after form submissions by non-administrative users
Correlate AEM access logs with endpoint telemetry to identify browser-based post-exploitation activity following visits to authoring pages

How to Mitigate CVE-2025-47011

Immediate Actions Required

Apply the Adobe security updates referenced in APSB25-48 to upgrade beyond AEM 6.5.22
Audit all AEM user accounts and revoke unnecessary content authoring or form-editing privileges
Inspect existing form field content for stored payloads and sanitize or remove suspicious entries

Patch Information

Adobe released fixes for CVE-2025-47011 as part of security bulletin APSB25-48. Administrators running AEM 6.5.x on-premise deployments must upgrade to the fixed service pack. AEM Cloud Service customers receive fixes through Adobe's managed release channel. Refer to the Adobe Experience Manager Security Advisory for exact fixed versions and upgrade procedures.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on AEM-rendered pages
Restrict form-editing and content-authoring permissions to trusted, vetted users only
Place a web application firewall (WAF) in front of AEM to filter payloads containing script tags and JavaScript URIs in form submissions

bash

# Example CSP header to reduce stored XSS impact on AEM-served pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'