CVE-2025-47055: Adobe Experience Manager XSS Vulnerability

CVE-2025-47055 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses a page rendering the affected field, the stored payload executes in their browser context. The flaw affects both on-premise AEM 6.5.x installations and Adobe Experience Manager Cloud Service. Adobe addressed the issue in security bulletin APSB25-48.

Critical Impact
Attackers with low-level authenticated access can inject persistent JavaScript into AEM form fields, executing arbitrary script in the browsers of authors, administrators, or site visitors who view the affected content.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service (affected releases)
AEM Forms components exposing user-controlled input fields

Discovery Timeline

2025-06-10 - CVE-2025-47055 published to the National Vulnerability Database
2025-06-10 - Adobe publishes security bulletin APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47055

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in Adobe Experience Manager form handling. AEM fails to properly sanitize or encode user-supplied input submitted to specific form fields before persisting it in the content repository. When the affected content is later rendered, the browser interprets the injected payload as executable JavaScript rather than inert data.

Because the payload is stored server-side, every user who loads the compromised page becomes a potential victim. The scope is marked as changed in the CVSS vector, indicating the vulnerable component and the impacted component differ. This typically occurs when script executes in an authenticated administrator's browser session, allowing action within a higher privilege boundary than the attacker originally held.

Exploitation requires user interaction from a victim who must navigate to the page containing the injected field. Successful execution can lead to session token theft, forced actions in the AEM author environment, or defacement of published content.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM does not enforce sufficient output encoding or input validation on the affected form fields, permitting script tags and JavaScript event handlers to survive the persistence and rendering pipeline.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges, such as a content author or contributor role. The attacker submits crafted input containing JavaScript through a vulnerable form field within the AEM interface. The payload is stored in the Java Content Repository (JCR). When another user, typically a higher-privileged administrator or an end-visitor, requests the page, the browser executes the injected script under the origin of the AEM site.

For code-level details, refer to the Adobe Security Advisory APSB25-48.

Detection Methods for CVE-2025-47055

Indicators of Compromise

Form field values in the JCR containing <script> tags, javascript: URIs, or DOM event handlers such as onerror= and onload=
Unexpected outbound requests from author or publish instances to attacker-controlled domains referenced by injected scripts
Session cookies for AEM administrator accounts appearing in web server referer logs of external hosts
Modifications to form components authored by low-privileged accounts outside their normal working scope

Detection Strategies

Query the JCR for form node properties containing HTML tags or JavaScript keywords, and review results for unauthorized authoring activity
Enable and review AEM audit logs for content creation and modification events tied to low-privileged users
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from authored content

Monitoring Recommendations

Forward AEM access.log, error.log, and audit logs to a centralized logging or SIEM platform for correlation
Alert on anomalous form submissions containing angle brackets, quote characters, or script keywords in fields expected to hold plain text
Monitor administrator session activity for unexpected privileged actions performed shortly after visiting author pages

How to Mitigate CVE-2025-47055

Immediate Actions Required

Apply the Adobe Experience Manager security update referenced in bulletin APSB25-48 to all on-premise AEM 6.5.x instances
Verify AEM Cloud Service instances are running a version that includes the fix, upgrading if necessary
Review recently authored form components for injected script content and remove any malicious payloads
Rotate credentials and session tokens for administrator accounts that may have viewed compromised pages

Patch Information

Adobe released fixed versions addressing CVE-2025-47055 as documented in Adobe Security Advisory APSB25-48. On-premise operators should upgrade past AEM 6.5.22 to the patched service pack. AEM Cloud Service customers receive the fix through Adobe's managed release channel.

Workarounds

Restrict authoring permissions so only trusted users can create or modify form components until patching is complete
Deploy a strict Content Security Policy that disallows inline scripts on published pages to reduce payload execution
Configure a web application firewall (WAF) rule to block requests containing script tags in AEM form submission endpoints
Enable and enforce AEM's XSS protection APIs in custom components handling user-supplied input

bash

# Example WAF rule concept to block script payloads in AEM form submissions
# ModSecurity rule template
SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
  "id:1004705,phase:2,deny,status:403,\
   msg:'Potential stored XSS attempt against AEM (CVE-2025-47055)',\
   tag:'CVE-2025-47055'"