CVE-2025-48063: XWiki Required Rights Bypass RCE Flaw

CVE-2025-48063 Overview

CVE-2025-48063 is an authorization bypass vulnerability in XWiki, a generic Java-based wiki platform. The flaw resides in the required rights enforcement logic introduced in XWiki 16.10.0. A user with edit rights on a document can set programming right as a required right, even when that user does not possess programming right. If a privileged user later edits the same document, its content gains programming right, enabling remote code execution. The issue is tracked as [CWE-285: Improper Authorization] and affects XWiki releases prior to 16.10.4 and 17.1.0RC1.

Critical Impact
A low-privileged editor can stage a document that escalates to programming right when subsequently edited by an administrator, leading to arbitrary code execution on the wiki server.

Affected Products

XWiki Platform 16.10.0 through 16.10.3
XWiki Platform 17.0.0 and 17.0.0-rc1
XWiki releases prior to 17.1.0RC1

Discovery Timeline

2025-05-21 - CVE-2025-48063 published to NVD
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2025-48063

Vulnerability Analysis

XWiki 16.10.0 introduced required rights to constrain which rights a document may exercise. The security model assumes that a user lacking a given right cannot declare it as required, preventing privilege smuggling between editors. The implementation failed to enforce this invariant for programming right.

Any user holding edit right on a document can mark programming right as required. When an administrator with programming right subsequently saves the document, the document content inherits programming right. Programming right in XWiki grants execution of Velocity, Groovy, and other server-side scripts with full privileges, which results in remote code execution on the wiki host.

XWiki still runs the required rights analysis at edit time, so the privileged editor receives a warning about dangerous content. An attacker who can suppress or bypass the warning UI removes the last safety net. The vulnerability is categorized under [CWE-285: Improper Authorization].

Root Cause

The defect lives in the authorization bridge that validates required rights against the document author. The check did not consistently reject programming right declarations from authors lacking that right, allowing the declaration to persist. The patched class RightsFilterListener corrects related scope handling when the required right scope is null.

Attack Vector

Exploitation requires an authenticated account with edit rights on at least one document and a follow-on edit by a user holding programming right. The attack vector is network-based and user-interaction dependent. Impact is constrained because affected versions ship no UI to enforce required rights wiki-wide, limiting real-world attack surface.

java

                } catch (AccessDeniedException e) {
                    event.cancel(
                        "The author doesn't have the right [%s] on the [%s] level that has been specified as required."
-                           .formatted(requiredRight.right().getName(), requiredRight.scope().getLowerCase()));
+                           .formatted(requiredRight.right().getName(), requiredRight.scope()));
                    break;
                }
            }

Source: XWiki Platform Patch Commit 2557813

Detection Methods for CVE-2025-48063

Indicators of Compromise

Document revisions where XWiki.RequiredRightClass objects declare programming as a required right, authored by accounts without programming right.
Unexpected Velocity or Groovy script blocks added to pages shortly after a required-right declaration was committed.
Outbound network connections or shell process spawns originating from the XWiki JVM after a privileged user saves a recently edited document.

Detection Strategies

Audit the XWiki database for RequiredRightClass objects and correlate the declaring author against the user rights table.
Review document history through the XWiki admin interface for required-right additions followed by edits from administrative accounts.
Inspect xwiki.log for AccessDeniedException entries from RightsFilterListener indicating required-right enforcement failures.

Monitoring Recommendations

Forward XWiki application and Tomcat logs to a centralized analytics platform and alert on process executions spawned by the servlet container.
Monitor file writes under WEB-INF/ and any execution of Runtime.exec or ProcessBuilder invocations from wiki rendering threads.
Track edits to pages that contain RequiredRightClass objects and flag any subsequent script content additions.

How to Mitigate CVE-2025-48063

Immediate Actions Required

Upgrade XWiki to version 16.10.4, 17.1.0RC1, or later as soon as practical.
Inventory existing documents for unauthorized RequiredRightClass objects and remove entries declared by non-privileged authors.
Restrict edit rights on sensitive spaces to trusted accounts until the upgrade is complete.

Patch Information

The fix landed in XWiki 16.10.4 and 17.1.0RC1. Refer to the GitHub Security Advisory GHSA-rhfv-688c-p6hp, the XWiki Issue Tracker XWIKI-22859, and the upstream commit 2557813 for code-level details.

Workarounds

No supported workaround exists; upgrading is the only remediation path.
As an interim control, administrators with programming right should avoid editing documents recently modified by lower-privileged users until the patch is applied.

bash

# Verify installed XWiki version against the fixed releases
curl -s https://wiki.example.com/xwiki/bin/view/Main/ | grep -i 'xwiki-version'

# Query the database for required-right declarations and their authors
mysql -u xwiki -p xwiki -e "SELECT XWD_FULLNAME, XWD_AUTHOR FROM xwikidoc \
  WHERE XWD_CONTENT LIKE '%RequiredRightClass%programming%';"