CVE-2025-51991: XWiki Server-Side Template RCE Flaw

CVE-2025-51991 Overview

CVE-2025-51991 is a Server-Side Template Injection (SSTI) vulnerability affecting XWiki through version 17.3.0. The flaw resides in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject Apache Velocity template code that XWiki renders server-side without proper validation or sandboxing. Successful exploitation enables execution of arbitrary template logic, exposure of internal server information, and in specific configurations, remote code execution or sensitive data leakage. The vulnerability is tracked under [CWE-79] and carries a CVSS 3.1 score of 8.8.

Critical Impact
Authenticated administrators can inject Velocity template code into XWiki configuration fields, achieving server-side template execution that may escalate to remote code execution or sensitive data disclosure.

Affected Products

XWiki versions through 17.3.0
XWiki Administration interface (Global Preferences module)
XWiki deployments exposing the Presentation configuration to administrative users

Discovery Timeline

2025-08-20 - CVE-2025-51991 published to NVD
2025-09-11 - Last updated in NVD database

Technical Details for CVE-2025-51991

Vulnerability Analysis

XWiki uses the Apache Velocity template engine to render dynamic content within wiki pages and administration settings. The HTTP Meta Info field within the Global Preferences Presentation section accepts administrator-supplied content that is later embedded into rendered HTTP meta tags. XWiki passes this input through the Velocity rendering pipeline without sanitizing template directives or applying a security sandbox. An authenticated user with administrative privileges can submit Velocity expressions that the server evaluates during page rendering. The resulting execution context exposes internal XWiki objects and, depending on deployment configuration, Java reflection primitives that enable command execution. The vulnerability sits at the intersection of administrative trust boundaries and unsafe dynamic rendering of configuration data.

Root Cause

The root cause is improper handling of dynamic template rendering within user-supplied configuration fields. XWiki treats the HTTP Meta Info field as renderable content rather than static text, and the rendering path lacks a Velocity security manager or directive allowlist. Configuration data persisted by administrators is later evaluated as executable template logic, violating separation between data and code.

Attack Vector

An attacker requires authenticated access with administrative privileges to the XWiki instance. The attacker navigates to the Global Preferences Presentation section and submits a Velocity payload into the HTTP Meta Info field. When any page renders the affected meta block, the Velocity engine evaluates the injected directives in the server context. Depending on accessible bindings, the attacker can read server state, invoke internal APIs, or chain to Java reflection for command execution. Refer to the GitHub CVE-2025-51991 Writeup for payload specifics.

Detection Methods for CVE-2025-51991

Indicators of Compromise

Unexpected modifications to the Global Preferences Presentation configuration, especially the HTTP Meta Info field containing Velocity syntax such as #set, $class, or ${...} constructs.
XWiki application logs showing Velocity rendering errors or reflection-related stack traces tied to administrative configuration pages.
Outbound network connections initiated by the XWiki Java process to unexpected destinations following administrative edits.
New or unusual administrator accounts created prior to configuration changes in the Presentation section.

Detection Strategies

Audit the XWiki object store and database tables holding XWikiPreferences for Velocity directives within the meta property.
Monitor HTTP POST requests to /xwiki/bin/save/XWiki/XWikiPreferences and similar administrative endpoints for payloads containing template syntax.
Inspect process telemetry on the XWiki host for child processes spawned by the Java runtime that lack a legitimate operational baseline.

Monitoring Recommendations

Enable verbose XWiki audit logging for administrative configuration changes and forward events to a centralized logging platform.
Alert on Velocity engine exceptions in xwiki.log that originate from rendering of preference fields.
Track administrator session activity and correlate configuration edits with subsequent anomalous server behavior.

How to Mitigate CVE-2025-51991

Immediate Actions Required

Restrict administrative access to trusted personnel and enforce multi-factor authentication on all XWiki administrator accounts.
Review the current value of the HTTP Meta Info field in Global Preferences and remove any Velocity directives that were not deliberately configured.
Rotate credentials for any administrator account that may have been compromised and audit recent administrative activity.

Patch Information

At the time of NVD publication, XWiki versions through 17.3.0 are affected. Monitor the XWiki Official Website for vendor advisories and upgrade to a fixed release as soon as one is available. Apply the patch in a staged environment before production rollout to validate template rendering changes against existing customizations.

Workarounds

Limit the admin and programming rights to a minimal set of accounts and remove these rights from any account that does not require them.
Place the XWiki administration interface behind a reverse proxy with IP allowlisting so that only trusted networks can reach /xwiki/bin/admin/ paths.
Deploy a web application firewall rule that inspects POST bodies to administrative endpoints and blocks Velocity directive patterns such as #set(, #evaluate(, and $class.forName.
Run the XWiki Java process under a low-privilege service account with restricted filesystem and outbound network access to contain post-exploitation impact.

bash

# Example WAF rule (ModSecurity) blocking Velocity directives in admin POSTs
SecRule REQUEST_URI "@beginsWith /xwiki/bin/save/XWiki/XWikiPreferences" \
    "chain,deny,status:403,id:1051991,msg:'Potential XWiki SSTI (CVE-2025-51991)'"
    SecRule REQUEST_BODY "@rx (#set\(|#evaluate\(|\$class\.forName|\$\{.*\})" \
        "t:none,t:urlDecodeUni"