CVE-2025-47071: Adobe Experience Manager XSS Vulnerability

CVE-2025-47071 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The injected script executes in a victim's browser when they load the page rendering the affected field. The flaw affects both on-premises AEM 6.5.x and AEM Cloud Service deployments.

Critical Impact
Stored script injection lets an authenticated attacker run arbitrary JavaScript in another user's browser session, enabling session data theft, UI redressing, or actions performed on behalf of the victim.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager as a Cloud Service (AEM CS)
AEM Forms components accepting user-supplied field input

Discovery Timeline

2025-06-10 - CVE-2025-47071 published to NVD
2025-06-10 - Adobe published Security Advisory APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47071

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. Input submitted through affected form fields is persisted server-side without sufficient output encoding. When a subsequent user requests the page containing the stored value, the browser interprets the attacker-controlled markup as executable JavaScript. The scope-changed nature of the flaw means script execution occurs under the origin of the AEM-hosted page, giving the attacker access to any content or credentials bound to that origin. Exploitation requires an authenticated low-privileged account and user interaction from the victim, typically loading the affected page.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as [CWE-79]. Adobe Experience Manager fails to escape or sanitize user-controllable data written to specific form field contexts before it is rendered back in HTML. Because the payload is stored in AEM's content repository, every subsequent view of the page delivers the payload to additional victims without further attacker interaction.

Attack Vector

An attacker with low-privileged authenticated access, such as an author or contributor, submits a JavaScript payload into a vulnerable form field. AEM persists the payload in the JCR content store. When an administrator, editor, or end user later browses the page rendering that field, the payload runs in the victim's browser under the AEM domain. Because the vulnerability crosses trust boundaries between low-privileged authors and higher-privileged administrators, it can be chained to escalate access, exfiltrate authenticated session data, or trigger administrative actions.

No public proof-of-concept exploit code has been verified for this issue. Refer to the Adobe Security Advisory APSB25-48 for vendor-published details.

Detection Methods for CVE-2025-47071

Indicators of Compromise

Form field values containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URIs persisted in the JCR repository
Unexpected outbound HTTP requests from author or publish instances to attacker-controlled domains sourced from browser sessions
Author accounts creating or modifying components at unusual times or from unusual IP addresses

Detection Strategies

Query the AEM JCR for stored property values matching common XSS payload patterns across cq:Page and form component nodes
Review AEM access.log and request.log entries for POSTs to form submission endpoints containing encoded script markup
Inspect Dispatcher and CDN logs for anomalous responses containing injected inline event handlers or <script> tags in previously known-clean pages

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on AEM-delivered pages
Alert on new or modified nodes under /content created by low-privileged accounts that contain HTML control characters in text properties
Correlate author session activity with subsequent editor or administrator page views to identify possible victim exposure

How to Mitigate CVE-2025-47071

Immediate Actions Required

Upgrade on-premises Adobe Experience Manager to a version later than 6.5.22 as directed in Adobe advisory APSB25-48
Confirm AEM as a Cloud Service instances are running the latest release channel that includes the vendor fix
Audit low-privileged author accounts and revoke unused or overly permissive form-editing permissions

Patch Information

Adobe released fixed versions of Experience Manager on 2025-06-10 alongside the Adobe Security Advisory APSB25-48. Customers on AEM 6.5.x must apply the Service Pack listed in that bulletin. AEM as a Cloud Service customers receive the fix through the standard Adobe-managed release pipeline.

Workarounds

Restrict access to form authoring components so that only vetted, trusted users hold write permissions on affected node types
Deploy a strict Content Security Policy that blocks inline scripts and untrusted script sources on AEM-published pages
Configure Dispatcher rules to filter suspicious characters in form submissions where the fields do not require HTML input
Sanitize stored form field values by running a content review against the JCR before applying the vendor patch

bash

# Example Dispatcher filter to block obvious script markup in form POST bodies
/0100 { /type "deny" /method "POST" /url "*<script*" }
/0101 { /type "deny" /method "POST" /url "*javascript:*" }
/0102 { /type "deny" /method "POST" /url "*onerror=*" }