CVE-2025-47050: Adobe Experience Manager XSS Vulnerability

CVE-2025-47050 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any victim who visits the page containing the affected field.

The issue affects both the on-premises AEM 6.5 line and the AEM Cloud Service. Exploitation requires user interaction and low-privilege access to the authoring environment. Successful attacks can hijack sessions, alter rendered content, or redirect users to attacker-controlled destinations.

Critical Impact
A low-privileged authenticated attacker can persist malicious JavaScript in form fields, causing script execution in any visitor's browser and enabling session theft or content manipulation across the affected AEM instance.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
AEM Forms components handling user-supplied field content

Discovery Timeline

2025-06-10 - CVE-2025-47050 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47050

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. Input submitted to certain form fields is persisted without adequate output encoding. When another user renders a page containing the stored value, the browser interprets the injected markup as executable script.

The attack path requires authenticated access with low privileges, such as a content author role. The attacker crafts a payload, saves it to a vulnerable field, and waits for a victim to load the affected page. Because the payload is stored server-side, every subsequent visitor executes the script until the record is sanitized or removed.

The scope-changed nature of the issue means script execution can affect users outside the attacker's original security context. This is characteristic of stored XSS in shared content management platforms where authors and consumers cross trust boundaries.

Root Cause

The root cause is insufficient neutralization of user-supplied input in form field rendering paths [CWE-79]. AEM stores field values submitted through authoring interfaces and later serializes them into HTML output without escaping control characters such as <, >, and ". The missing contextual output encoding allows attacker-controlled content to break out of the intended data context and enter the script execution context.

Attack Vector

An authenticated attacker with content-authoring privileges submits a JavaScript payload through a vulnerable form field in the AEM authoring interface. The payload is persisted to the JCR repository. When a victim navigates to the page containing the field, AEM renders the stored value into the DOM. The browser parses the injected <script> tag or event handler and executes the code with the victim's session context.

Exploitation requires user interaction: the victim must load the affected page. No additional privileges are required for the victim, and administrators reviewing authored content are common targets.

No public proof-of-concept exploit is available in Exploit-DB or vendor references at the time of writing. Consult the Adobe Experience Manager Advisory APSB25-48 for the vendor's technical description.

Detection Methods for CVE-2025-47050

Indicators of Compromise

Form field values in the JCR repository containing <script>, javascript:, onerror=, onload=, or other event handler markup
Unexpected outbound requests from author or publish nodes to attacker-controlled domains following page renders
Session cookies or CSRF tokens appearing in web server or proxy logs as query string parameters
Modifications to content pages by author accounts with no legitimate reason to edit affected components

Detection Strategies

Query the AEM content repository for stored values matching XSS payload patterns using JCR-SQL2 or Query Builder
Enable and review AEM audit logs for content modifications to form components by low-privileged users
Deploy a Web Application Firewall (WAF) rule set to inspect responses from AEM publish instances for reflected script content
Correlate author login events with subsequent content modifications to identify anomalous authoring behavior

Monitoring Recommendations

Forward AEM access.log, audit.log, and request.log to a centralized SIEM for retention and correlation
Monitor Content Security Policy (CSP) violation reports from published pages to surface injected script attempts
Alert on creation or modification of form components outside standard change windows
Track privilege assignments in the AEM user manager for unexpected escalations to author or content-editor groups

How to Mitigate CVE-2025-47050

Immediate Actions Required

Upgrade Adobe Experience Manager on-premises deployments to a version later than 6.5.22 per Adobe's advisory
Update AEM as a Cloud Service tenants to the current release; Adobe manages patching for cloud tenants
Audit form component content authored between the introduction of the vulnerable code and patch deployment for injected script
Rotate session tokens and force reauthentication for author and administrator accounts if compromise is suspected

Patch Information

Adobe released fixes in security bulletin APSB25-48. Apply the AEM 6.5 Service Pack that supersedes 6.5.22, or ensure AEM as a Cloud Service instances are on the current release channel. See the Adobe Experience Manager Advisory APSB25-48 for exact fixed versions and download locations.

Workarounds

Restrict author-level access to trusted personnel and enforce least privilege on content editor groups
Deploy a strict Content Security Policy on publish instances to block inline script execution
Configure a WAF in front of AEM publish nodes to filter payloads containing script tags and JavaScript event handlers
Review and sanitize existing form field content in the JCR repository before applying broader mitigations

bash

# Example: AEM JCR query to identify potentially malicious stored content
# Run via /libs/cq/search/content/querydebug.html or curl
curl -u admin:PASSWORD \
  "https://aem-author.example.com/bin/querybuilder.json?type=nt:unstructured&fulltext=%3Cscript&p.limit=100"