CVE-2025-58049: XWiki Platform Information Disclosure Flaw

CVE-2025-58049 Overview

XWiki Platform, a generic wiki platform offering runtime services for applications built on top of it, contains a sensitive data exposure vulnerability in its PDF export functionality. In affected versions, the PDF export jobs store sensitive cookies unencrypted in job statuses. This improper data handling means that authentication cookies and session information are persisted in plain text, potentially allowing attackers who gain access to XWiki's data directory (such as through backups) to retrieve sensitive credentials.

Critical Impact

Sensitive authentication cookies stored in plain text within PDF export job statuses can be exposed through data directory access, enabling credential theft and session hijacking.

Affected Products

• XWiki Platform versions 14.4.2 to before 16.4.8
• XWiki Platform versions 16.5.0-rc-1 to before 16.10.7
• XWiki Platform versions 17.0.0-rc-1 to before 17.4.0-rc-1

Discovery Timeline

• 2025-08-28 - CVE CVE-2025-58049 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-58049

Vulnerability Analysis

This vulnerability is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The core issue lies in how XWiki's PDF export functionality handles sensitive request context data. When a PDF export job is created, the job request stores the complete request context including session cookies, authentication headers, and other sensitive request information. This data persists in the job status after the export completes, remaining accessible in the XWiki data directory.

The vulnerability enables attackers with access to backup files or the data directory to extract plain text authentication cookies. This represents a significant confidentiality breach as credentials should never be stored in an unencrypted, recoverable format. The network attack vector with no authentication requirements makes this vulnerability particularly concerning for environments where backup access controls may be less stringent than application-level controls.

Root Cause

The root cause is the failure to sanitize sensitive information from the PDF export job request after the job completes. The PDFExportJob class stored the complete request context including request.session, request.headers, and request.cookies keys in the job status without any cleanup mechanism. This design oversight violated the security principle that passwords and session tokens should never be stored in plain text.

Attack Vector

An attacker can exploit this vulnerability through the following attack flow:

1. Gain access to XWiki's data directory through backup files, misconfigured storage, or another vulnerability
2. Locate PDF export job status files that contain stored request context data
3. Extract sensitive cookies and authentication tokens from the plain text storage
4. Use the recovered credentials to impersonate legitimate users or hijack active sessions

The attack requires no user interaction and can be performed without prior authentication to the XWiki instance, though access to the underlying data storage is required.

// Security patch - Cleanup sensitive data after PDF export job completion
// Source: https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539

@Override
protected void runInternal() throws Exception
{
    try {
        exportAsPDF();
    } finally {
        cleanup();
    }
}

private void cleanup()
{
    // Avoid saving sensitive information along with the PDF export job status. This information is not needed
    // anymore after the PDF export job is done (whether the PDF is generated client-side or server-side).
    getRequest().getContext().keySet().removeAll(List.of("request.session", "request.headers", "request.cookies"));
}

private void exportAsPDF() throws Exception
{
    if (!this.request.getDocuments().isEmpty()) {
        this.requiredSkinExtensionsRecorder.start();

Source: GitHub Commit Update

Detection Methods for CVE-2025-58049

Indicators of Compromise

• Unexpected access to XWiki data directory or backup files by unauthorized users or processes
• Job status files containing sensitive request context data (request.session, request.headers, request.cookies)
• Authentication anomalies indicating session tokens being used from unexpected locations or IP addresses
• Evidence of backup file extraction or exfiltration from XWiki storage locations

Detection Strategies

• Monitor file system access to XWiki's data directory and job status storage locations for unauthorized read operations
• Implement audit logging for backup access and data directory operations
• Deploy file integrity monitoring (FIM) on XWiki data directories to detect unexpected access patterns
• Review authentication logs for session reuse from different client fingerprints or geographic locations

Monitoring Recommendations

• Configure alerts for access to PDF export job status files outside of normal application context
• Implement network monitoring to detect data exfiltration attempts from XWiki storage locations
• Enable detailed audit trails for backup operations involving XWiki data
• Monitor for authentication events using credentials that may have been extracted from job status files

How to Mitigate CVE-2025-58049

Immediate Actions Required

• Upgrade XWiki Platform to version 16.4.8, 16.10.7, or 17.4.0-rc-1 or later immediately
• Rotate all user credentials and invalidate existing sessions after upgrading
• Review backup access controls and restrict data directory access to essential personnel only
• Audit existing backups for potential exposure and consider secure deletion of affected backup files

Patch Information

XWiki has released patches addressing this vulnerability in versions 16.4.8, 16.10.7, and 17.4.0-rc-1. The fix implements a cleanup() method in the PDFExportJob class that removes sensitive context keys (request.session, request.headers, request.cookies) from the job request after the PDF export completes. For detailed information, refer to the GitHub Security Advisory GHSA-9m7c-m33f-3429 and the XWiki Issue Tracker Entry XWIKI-23151.

Workarounds

• Restrict access to XWiki's data directory using file system permissions to limit exposure of job status files
• Implement encryption at rest for XWiki data directories and backup storage
• Consider disabling PDF export functionality temporarily if immediate patching is not possible
• Deploy network segmentation to isolate XWiki storage from less trusted network segments

# Configuration example - Restrict data directory permissions
# Limit access to XWiki data directory
chmod 700 /var/lib/xwiki/data
chown xwiki:xwiki /var/lib/xwiki/data

# Ensure backup directories have restricted access
chmod 700 /backup/xwiki
chown root:root /backup/xwiki