CVE-2025-47065: Adobe Experience Manager XSS Vulnerability

CVE-2025-47065 Overview

CVE-2025-47065 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including AEM Cloud Service. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload persists on the server and executes in a victim's browser when the affected page is rendered. Exploitation requires user interaction and can lead to session compromise, credential theft, or unauthorized actions performed in the victim's context. Adobe published the fix in security bulletin APSB25-48.

Critical Impact
Authenticated attackers can persist malicious scripts in AEM form fields, hijacking sessions or performing actions as any user who visits the affected page.

Affected Products

Adobe Experience Manager (on-premises) versions 6.5.22 and earlier
Adobe Experience Manager Cloud Service (AEM CS) affected releases
AEM Forms components handling untrusted field input

Discovery Timeline

2025-06-10 - CVE-2025-47065 published to NVD
2025-06-10 - Adobe releases security bulletin APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47065

Vulnerability Analysis

The flaw is a stored (persistent) XSS defect in AEM form field handling. AEM accepts attacker-controlled input, stores it in the repository, and later reflects it into rendered HTML without adequate output encoding. When another user browses the page containing the tainted field, the injected JavaScript executes in that user's browser session under the AEM origin.

Because the scope is changed (S:C), the injected script can affect resources beyond the vulnerable component, including parent frames, administrative interfaces, or authoring sessions that share the origin. Impact includes session token theft, forced actions via the AEM API, defacement of authored content, and pivoting to higher-privileged accounts through social engineering.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as [CWE-79]. AEM form field processing fails to encode HTML control characters such as <, >, ", and ' before writing user-supplied values back into the DOM. The AEM XSSAPI encoding helpers are either not invoked or invoked with an insufficient context for the sink location.

Attack Vector

Exploitation requires an authenticated attacker with low privileges, such as an author or contributor role that can edit form fields. The attacker submits a payload containing an HTML <script> tag or an event handler such as onerror into a vulnerable field. The payload is stored in the JCR repository. A victim, typically an authoring or administrative user, later navigates to the page and triggers script execution. Because AEM authoring sessions often hold elevated privileges, the attacker can escalate impact through the authenticated victim's browser.

No verified public proof-of-concept exists for this CVE. Refer to the Adobe Security Advisory APSB25-48 for vendor-supplied technical details.

Detection Methods for CVE-2025-47065

Indicators of Compromise

Form field values in the JCR containing <script>, javascript:, or DOM event handlers such as onerror=, onload=, onmouseover=
Outbound HTTP requests from author or publish instances to unknown domains carrying cookie or token data
Unexpected changes to AEM content authored by low-privileged users on high-value pages

Detection Strategies

Query the JCR repository for stored properties containing HTML tags or JavaScript URI schemes in form-related node types
Inspect access logs for POST requests to /content/forms/ paths carrying encoded script payloads
Deploy a Content Security Policy (CSP) in report-only mode to surface script execution from unexpected inline sources

Monitoring Recommendations

Forward AEM error.log, request.log, and dispatcher access logs to a centralized SIEM for correlation
Alert on authenticated author sessions issuing unusual outbound requests immediately after page loads
Monitor privilege changes and new user creation events in AEM following suspicious form submissions

How to Mitigate CVE-2025-47065

Immediate Actions Required

Upgrade Adobe Experience Manager on-premises to a version later than 6.5.22 as directed in APSB25-48
Validate that AEM Cloud Service instances have received the vendor-deployed fix
Audit low-privileged user accounts that can edit form fields and revoke unnecessary write permissions
Purge or sanitize any existing stored form field values that contain HTML or script markup

Patch Information

Adobe addressed CVE-2025-47065 in security bulletin APSB25-48, released on 2025-06-10. On-premises customers must apply the AEM 6.5 Service Pack that supersedes 6.5.22. AEM as a Cloud Service customers receive the fix through Adobe's managed release channel. See the Adobe Security Advisory APSB25-48 for exact patch versions and installation guidance.

Workarounds

Enforce a restrictive Content Security Policy that disallows inline scripts and limits script-src to trusted origins
Configure the AEM Dispatcher to filter request parameters containing HTML tags or JavaScript URI schemes
Apply the AEM XSSAPI output encoding to all custom components that render form field values
Restrict form authoring permissions to trusted users pending patch deployment

bash

# Example Dispatcher filter to block script payloads in form parameters
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }
/0102 { /type "deny" /url "*onerror=*" }