CVE-2025-47116: Adobe Experience Manager XSS Vulnerability

CVE-2025-47116 Overview

CVE-2025-47116 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including the AEM Cloud Service. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload persists in the application and executes in the browser of any user who loads the page containing the affected field. Successful exploitation requires user interaction from the victim. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. Adobe published fixes in security advisory APSB25-48.

Critical Impact
A low-privileged attacker can inject persistent JavaScript into AEM form fields, enabling session hijacking, credential theft, and unauthorized actions in the context of visiting users.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service (affected releases per APSB25-48)
AEM instances exposing form authoring or editing components to low-privileged authors

Discovery Timeline

2025-06-10 - CVE-2025-47116 published to the National Vulnerability Database
2025-06-10 - Adobe releases security advisory APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47116

Vulnerability Analysis

The vulnerability is a stored XSS in Adobe Experience Manager form handling. AEM fails to sufficiently neutralize script content submitted into certain form fields before persisting and rendering that content back to viewers. Because the payload is stored server-side, every subsequent visitor who loads the affected page triggers execution of attacker-controlled JavaScript.

The attack requires authenticated access with low privileges, such as an author or contributor role that can submit or edit form content. The scope is changed, meaning injected script can affect resources or users beyond the attacker's own security context. This makes the flaw useful for lateral targeting of administrators or higher-privileged AEM users who browse content authored by lower-tier accounts.

Impact is limited to confidentiality and integrity within the browser context. Attackers can steal session cookies, exfiltrate CSRF tokens, alter rendered content, or pivot to administrative actions if a privileged user views the poisoned page.

Root Cause

The root cause is improper output encoding and input sanitization on form field values within AEM components. User-supplied HTML or script content is written into the DOM without contextually appropriate escaping, allowing <script> tags and event handlers to survive the render pipeline.

Attack Vector

Exploitation proceeds over the network against an authenticated AEM instance. An attacker with a low-privileged account submits a crafted payload into a vulnerable form field. The payload is stored in the AEM repository. When a victim later navigates to the page hosting the field, the browser parses and executes the injected script in the origin of the AEM site.

No verified public proof-of-concept exploit is available. Refer to the Adobe Security Advisory APSB25-48 for vendor technical details.

Detection Methods for CVE-2025-47116

Indicators of Compromise

Form field values in the AEM repository containing <script>, javascript:, onerror=, onload=, or other event-handler markup.
Unexpected outbound requests from author or publish instances to attacker-controlled domains referenced in stored content.
Author account activity that modifies form components outside of normal working hours or from unusual source IP addresses.

Detection Strategies

Review AEM audit logs (/var/audit) for form field edits by low-privileged users and correlate against content that later triggered browser errors.
Scan JCR content nodes for properties containing HTML tags or JavaScript URI schemes using tools like oak-run or custom Groovy scripts.
Deploy Content Security Policy (CSP) violation reporting to surface script executions that fall outside allowed sources.

Monitoring Recommendations

Alert on repeated edits to form components by non-administrative accounts.
Monitor web application firewall logs for script tag patterns in POST requests to /content/* and form submission endpoints.
Track anomalous session activity for administrators viewing pages recently modified by low-privileged authors.

How to Mitigate CVE-2025-47116

Immediate Actions Required

Apply the patched AEM version identified in Adobe Security Advisory APSB25-48 to all on-premise instances.
Confirm AEM Cloud Service tenants are on the fixed release channel published by Adobe.
Audit existing form content for injected scripts and remove or sanitize any suspicious entries before restoring public access.

Patch Information

Adobe addressed CVE-2025-47116 in the security update described in APSB25-48, covering AEM 6.5.23 and the corresponding AEM Cloud Service release. Administrators should follow the standard AEM service pack installation procedure and validate customizations against the updated codebase.

Workarounds

Restrict form authoring permissions to trusted users until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts on rendered content pages.
Place AEM author instances behind a VPN or IP allow-list to limit exposure of low-privileged authenticated attack surface.

bash

# Example CSP header to reduce stored XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'