CVE-2025-49581: XWiki Platform RCE Vulnerability

CVE-2025-49581 Overview

CVE-2025-49581 affects XWiki, a generic open-source wiki platform. The vulnerability allows any authenticated user with edit rights on a page to execute Groovy, Python, or Velocity code with programming rights by defining a wiki macro. The flaw stems from how XWiki processes wiki macro parameter default values when the parameter allows wiki syntax. Default values execute with the rights of the document author rather than the macro author. An attacker can override macros such as the children macro used in pages with programming rights like XWiki.ChildrenMacro, enabling arbitrary script execution and full access to the XWiki installation.

Critical Impact
Authenticated low-privileged users can achieve arbitrary code execution and full administrative control over the XWiki installation by exploiting macro parameter default value evaluation.

Affected Products

XWiki Platform versions prior to 16.4.7
XWiki Platform 16.5.0 through 16.10.2
XWiki Platform 17.0.0 RC1

Discovery Timeline

2025-06-13 - CVE-2025-49581 published to NVD
2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-49581

Vulnerability Analysis

The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection). XWiki's wiki macro system allows administrators to define reusable macros whose parameters can accept wiki syntax. When a parameter's value is not provided by the caller, XWiki falls back to the parameter's default value. The renderer executed this default value in the context of the document where the macro was invoked rather than the document that defined the macro. This rights confusion permits a low-privileged user to leverage privileged macros stored in documents that hold programming rights.

Root Cause

The root cause lies in DefaultWikiMacroRenderer.java within the xwiki-platform-rendering-wikimacro-store module. The renderer evaluated wiki macro parameter default values using the rights of the invoking document's author. When a privileged document like XWiki.ChildrenMacro invoked a redefined macro, attacker-controlled default values inherited programming rights. This allowed bypassing the required rights checks that normally restrict script macro execution.

Attack Vector

An attacker with edit rights on any page, including their own user profile, defines a wiki macro that overrides a standard macro such as children. The malicious macro declares a parameter whose default value contains a script macro (Groovy, Python, or Velocity). When a privileged page like XWiki.ChildrenMacro renders and invokes the overridden macro without supplying that parameter, the attacker's script executes with programming rights.

java

// Patch excerpt from DefaultWikiMacroRenderer.java
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

Source: XWiki Platform commit c99d501

The fix introduces a dependency on xwiki-platform-security-requiredrights-default and modifies the renderer to evaluate default parameter values in the macro author's context rather than the caller's context.

Detection Methods for CVE-2025-49581

Indicators of Compromise

Unexpected creation or modification of wiki macro definitions in user profile pages or other low-privilege documents.
Wiki macros whose names match privileged built-in macros such as children, include, or display.
Macro parameter definitions containing script macro syntax ({{groovy}}, {{python}}, {{velocity}}) inside default values.
Outbound network connections or shell command execution originating from the XWiki JVM process.

Detection Strategies

Audit the XWiki object store for XWiki.WikiMacroParameterClass instances and inspect defaultValue fields for embedded script macros.
Review XWiki audit logs for edits to pages by users whose profile pages were recently modified.
Monitor JVM child process creation and unusual filesystem writes by the application server account running XWiki.

Monitoring Recommendations

Enable verbose rendering and security logs in XWiki to capture programming-rights macro executions.
Forward XWiki application logs and host telemetry to a centralized analytics platform for correlation against macro-definition events.
Alert on edits to pages matching XWiki.*Macro patterns performed by non-administrative accounts.

How to Mitigate CVE-2025-49581

Immediate Actions Required

Upgrade XWiki to version 16.4.7, 16.10.3, or 17.0.0 immediately.
Restrict edit rights on user profile pages and review which accounts hold edit rights across the wiki.
Audit existing wiki macro definitions and remove any that override built-in macros or contain script macros in default parameter values.

Patch Information

The vulnerability is patched in commit c99d501ed41cbee6a3c02ff927714531570789de. The fix executes wiki macro parameter default values with the rights of the wiki macro's author instead of the calling document's author. See the XWiki GitHub Security Advisory GHSA-9875-cw22-f7cx and XWiki Jira issue XWIKI-22760 for full details.

Workarounds

Remove programming rights from documents that invoke overridable macros, including XWiki.ChildrenMacro, until patching is complete.
Limit edit rights to trusted users only and disable self-registration if the wiki is exposed publicly.
Disable wiki macro creation for non-administrative users through XWiki's rights management.

bash

# Verify installed XWiki version after upgrade
curl -s https://your-xwiki-host/xwiki/bin/view/Main/ \
  | grep -i 'xwiki.version'

# Recommended fixed versions: 16.4.7, 16.10.3, or 17.0.0