CVE-2025-49585: XWiki XWiki RCE Vulnerability

CVE-2025-49585 Overview

CVE-2025-49585 affects XWiki, a generic wiki platform widely used for collaborative documentation and knowledge management. The vulnerability allows an attacker with only edit rights to inject malicious code into XClass property definitions. When a privileged user later edits the same document, the injected code executes with the editor's script, admin, or programming rights. This affects custom display code, computed property scripts, and database list property queries. The flaw is tracked under CWE-357: Insufficient UI Warning of Dangerous Operations.

Critical Impact
Low-privileged attackers can achieve arbitrary code execution by waiting for an admin or programmer to edit a tampered XClass definition, leading to full wiki compromise.

Affected Products

XWiki Platform versions prior to 15.10.16
XWiki Platform versions 16.0.0-rc-1 through 16.4.6
XWiki Platform versions 16.5.0-rc-1 through 16.10.1

Discovery Timeline

2025-06-13 - CVE-2025-49585 published to NVD
2025-09-03 - Last updated in NVD database

Technical Details for CVE-2025-49585

Vulnerability Analysis

The vulnerability resides in how XWiki processes XClass property definitions during document editing. XWiki allows administrators to define structured content types through XClass definitions, which can include custom display logic, computed properties, and database list queries written in scripting languages.

When an attacker with edit rights but without script or programming rights creates an XClass definition, they can embed malicious script code in property fields. These fields are not executed in the context of the unprivileged creator. However, when a user with elevated rights later opens the same document for editing, the embedded code is evaluated with that user's privileges. This results in privilege escalation from edit-level access to script, admin, or programming-level code execution.

Warnings before editing documents with dangerous properties were only introduced in XWiki 15.9. In earlier versions, this behavior was a known issue with user-caution as the only mitigation.

Root Cause

The root cause is the absence of static analysis for XClass property scripts before allowing privileged users to edit the parent document. Custom display code, computed property scripts, and queries in database list properties were processed without validating whether their content originated from a low-privilege author. This violates the principle that code authored by an unprivileged user must not silently execute under a privileged context.

Attack Vector

The attack requires network access to the XWiki instance and authenticated edit rights on at least one document. The attacker creates or modifies an XClass definition containing malicious Velocity, Groovy, or scripting payloads inside dangerous property fields. The attacker then waits for, or socially engineers, an administrator or programmer to edit the same document. Upon edit, the injected code executes server-side under the privileged user's permissions, enabling arbitrary command execution, data exfiltration, or wiki takeover.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-59w6-r9hm-439h and tracked in XWiki Jira Issue XWIKI-22476.

Detection Methods for CVE-2025-49585

Indicators of Compromise

Unexpected modifications to XClass documents made by users without script or programming rights
Presence of Velocity, Groovy, or Python script fragments in customDisplay, computed property, or database list query fields authored by low-privilege accounts
Audit log entries showing privileged users editing documents shortly after low-privilege XClass modifications

Detection Strategies

Review XWiki document revision history for XClass property changes made by users lacking script or programming rights
Inspect XClass property fields for script syntax that does not match expected schema content
Correlate document edit events between low-privilege authors and subsequent privileged editors on the same XClass documents

Monitoring Recommendations

Enable XWiki audit logging for all XObject and XClass modifications and forward events to a centralized SIEM
Alert on edit events to XClass documents where the author lacks programming rights but the document contains script-bearing properties
Monitor process execution and outbound network connections from the XWiki JVM for anomalous activity following document edits

How to Mitigate CVE-2025-49585

Immediate Actions Required

Upgrade XWiki to version 15.10.16, 16.4.7, or 16.10.2 as soon as possible
Audit all XClass definitions for unauthorized script content in custom display, computed property, and database list query fields
Restrict edit rights on sensitive XClass documents to trusted users until patches are applied

Patch Information

The issue has been patched in XWiki 16.10.2, 16.4.7, and 15.10.16. The fix adds analysis for the affected XClass properties to warn or block privileged users before they edit documents containing dangerous content authored by less-privileged users. Patch details are available in GitHub commit 385bde9.

Workarounds

Administrators and programmers should avoid editing XClass documents created or modified by users without script and programming rights until patched
Manually inspect XClass property definitions before opening them in the editor on unpatched instances
Limit assignment of edit rights on XClass-containing spaces to vetted users

bash

# Verify installed XWiki version and upgrade target
# Replace with your deployment's package manager or WAR deployment workflow

# Check current version
curl -s https://your-xwiki/xwiki/bin/view/Main/ | grep -i 'version'

# Recommended fixed versions
# - 15.10.16
# - 16.4.7
# - 16.10.2