CVE-2025-47056: Adobe Experience Manager XSS Vulnerability

CVE-2025-47056 Overview

CVE-2025-47056 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including AEM Cloud Service. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load a page containing the tainted field.

The issue is tracked under [CWE-79] Improper Neutralization of Input During Web Page Generation. Adobe published fixes in security bulletin APSB25-48.

Critical Impact
Stored XSS in AEM form fields allows attackers to run arbitrary JavaScript in the context of a victim's session, enabling session token theft, UI redressing, and abuse of authenticated actions within the AEM author or publish environment.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM CS) — versions prior to the APSB25-48 fix
AEM Forms component containing the vulnerable input fields

Discovery Timeline

2025-06-10 - CVE-2025-47056 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47056

Vulnerability Analysis

The vulnerability is a stored XSS flaw in form field handling within Adobe Experience Manager. AEM fails to properly neutralize attacker-supplied input before persisting it and rendering it back to users. When a victim navigates to a page containing the affected field, the stored payload is served as part of the HTML response and executed by the browser.

Exploitation requires the attacker to hold a low-privileged account with permission to submit or edit form field content. It also requires user interaction, meaning a victim must load the page hosting the payload. The scope is changed, so injected script can affect security-relevant data outside the vulnerable component's boundary, such as the parent authoring session.

Successful exploitation typically leads to session hijacking, content defacement, credential harvesting through cloned login prompts, or lateral actions performed as the victim within AEM.

Root Cause

The root cause is missing or insufficient output encoding on form field values before they are inserted into the DOM. Input written by an authenticated contributor is stored in the repository and later reflected into a rendered page without HTML or JavaScript context-aware escaping, allowing <script> tags or event handler attributes to survive to the browser.

Attack Vector

The attack is network-based and requires authentication as a low-privileged user with content-editing rights. The attacker submits crafted content, such as JavaScript inside a form field, and waits for another user, often a higher-privileged author or an end user, to browse the affected page.

Because no verified public proof-of-concept is available, refer to the Adobe Security Advisory APSB25-48 for further technical details.

Detection Methods for CVE-2025-47056

Indicators of Compromise

Form field values in the AEM repository containing <script>, javascript:, or event handler attributes such as onerror= and onload=
Unexpected outbound HTTP requests from author or publish nodes to attacker-controlled domains carrying cookie or token data
Anomalous JavaScript errors or Content Security Policy violations logged when authors browse content pages

Detection Strategies

Scan jcr:content nodes and form component properties for HTML tags or JavaScript keywords in fields that should contain plain text
Review AEM access.log and request.log for POST requests to form submission endpoints containing URL-encoded script payloads from low-privileged accounts
Correlate content modification events from low-privileged users with subsequent page views by administrators to identify targeted XSS delivery

Monitoring Recommendations

Enable and forward AEM audit logs and dispatcher logs to a centralized SIEM for retrospective search
Deploy Content Security Policy reporting to capture inline script violations on AEM-rendered pages
Monitor for privilege changes or new administrative sessions shortly after a content edit by a contributor account

How to Mitigate CVE-2025-47056

Immediate Actions Required

Upgrade Adobe Experience Manager to the fixed release identified in APSB25-48, above version 6.5.22 for on-premises deployments
Verify AEM Cloud Service instances are on the current release channel that includes the APSB25-48 fix
Audit contributor and low-privileged author accounts, revoking access for accounts that do not require content editing rights

Patch Information

Adobe addressed CVE-2025-47056 in the security update documented in Adobe Security Advisory APSB25-48. Administrators should apply the AEM 6.5 Service Pack referenced in the advisory or confirm the corresponding Cloud Service release is active.

Workarounds

Configure AEM Dispatcher rules to reject requests containing script tags or JavaScript event handler patterns in form field parameters
Enforce a strict Content Security Policy that disallows inline scripts on AEM-delivered pages
Sanitize existing repository content by scanning form field properties and stripping HTML markup from fields that should contain plain text

bash

# Example Dispatcher filter to block script payloads in form submissions
/0100 { /type "deny" /method "POST" /url "*" /query "*<script*" }
/0101 { /type "deny" /method "POST" /url "*" /query "*javascript:*" }