CVE-2025-58365: XWiki Blog Application RCE Vulnerability

CVE-2025-58365 Overview

CVE-2025-58365 is a remote code execution vulnerability in the XWiki blog application affecting versions prior to 9.14. The flaw allows any authenticated user with edit rights on any page to execute arbitrary script code on the server. Since logged-in users can edit their own profile pages by default, the attack surface includes the entire authenticated user base. The vulnerability is classified as CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code, commonly known as Eval Injection. Exploitation requires adding a Blog.BlogPostClass object to a page and embedding a script macro in the Content field.

Critical Impact
Any authenticated XWiki user can achieve remote code execution on the server by abusing blog post content rendering, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

XWiki Blog Application versions prior to 9.14
XWiki Platform deployments with the blog application installed
Any XWiki instance allowing authenticated user profile editing

Discovery Timeline

2025-09-08 - CVE-2025-58365 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58365

Vulnerability Analysis

The XWiki blog application renders blog post content using script macros without enforcing author-level rights checks. When a blog post is displayed, the platform evaluates embedded script macros with the privileges of the rendering context rather than the privileges of the author who created the content. This privilege mismatch enables low-privileged users to execute Groovy, Velocity, or Python macros that would normally require programming rights.

The vulnerability is reachable by any user who can edit at least one page. In default XWiki configurations, every authenticated user can edit their own profile page, making the practical prerequisite a valid login session.

Root Cause

The root cause is improper handling of dynamically evaluated code in the blog rendering pipeline. The application executed the contents of blog posts without restricting macros to the rights granted to the post's author. The patch in version 9.14 introduces author-scoped rights enforcement, ensuring script macros execute with the privileges of the appropriate author rather than the rendering user.

Attack Vector

An attacker authenticates to the XWiki instance and navigates to a page they can edit, such as their own user profile. The attacker attaches a Blog.BlogPostClass object to the page using the class editor. Within the Content field of that object, the attacker embeds a script macro containing arbitrary Groovy or Velocity code. When the blog post is rendered, the malicious macro executes on the server with elevated rights, granting full access to the XWiki backend, file system, and connected databases.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-gwj6-xpfg-pxwr and tracked in the XWiki JIRA Ticket BLOG-191. No working exploit code is published in the references.

Detection Methods for CVE-2025-58365

Indicators of Compromise

Creation or modification of XObjects of type Blog.BlogPostClass attached to non-blog pages, particularly user profile pages
Blog post Content fields containing {{groovy}}, {{velocity}}, {{python}}, or other script macro invocations from non-administrative authors
Unexpected outbound network connections, file writes, or process executions originating from the XWiki JVM
New or modified pages by low-privileged users that include Blog.BlogPostClass objects shortly before suspicious server activity

Detection Strategies

Query the XWiki database for BlogPostClass objects on pages outside the expected blog space and review their Content fields for script macros
Enable XWiki audit logging and monitor XObject creation events correlated with the authoring user's rights level
Inspect web server access logs for POST requests to /xwiki/bin/save/ and /xwiki/bin/edit/ containing blog object parameters from non-blog editors

Monitoring Recommendations

Monitor the XWiki JVM process for child process creation, which is abnormal for a wiki workload
Alert on file system writes by the XWiki service account outside of standard data and cache directories
Track authentication events followed rapidly by profile edits and script macro execution patterns

How to Mitigate CVE-2025-58365

Immediate Actions Required

Upgrade the XWiki blog application to version 9.14 or later, which enforces author-rights checks during macro execution
Audit all existing pages for unexpected Blog.BlogPostClass objects and remove any added by non-administrative users
Review user accounts and revoke edit rights from accounts that do not require content authoring capabilities

Patch Information

The fix is implemented in the upstream commit b98ab6f17da3029576f42d12b4442cd555c7e0b4, which modifies the blog rendering logic to execute post content with the rights of the appropriate author rather than the viewing context. Administrators should obtain version 9.14 of the blog application from the XWiki extension repository and apply it through the Extension Manager.

Workarounds

No official workarounds are available according to the vendor advisory
As a temporary risk reduction measure, restrict the blog application or disable it on instances where it is not actively used
Consider tightening default edit rights on user profile pages until the patch is deployed

bash

# Verify installed blog application version through the XWiki Extension Manager API
curl -u admin:password \
  "https://xwiki.example.com/xwiki/rest/extensions/org.xwiki.contrib.blog:application-blog-ui"

# After patching, confirm version 9.14 or later is installed