CVE-2025-32970

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32970
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32970.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32970
Aliases
Published
2025-04-30T14:54:52.008Z
Modified
2026-04-10T05:25:18.546719Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Details

XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32970.json",
    "cwe_ids": [
        "CWE-601"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
f36d6f0081ab89ac8ba6a8176e542d646defaabd
Fixed
97e8f148873bd95834ed6f93e564bbf77070ea2b
Database specific 
{
    "versions": [
        {
            "introduced": "13.5-rc-1"
        },
        {
            "fixed": "15.10.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
6f103dbca9c98cf3b53bfadb83d982facb198d56
Fixed
c20d0fd69f97fd2d2eaa6c78d785f2097ed5a5d0
Database specific 
{
    "versions": [
        {
            "introduced": "16.0.0-rc-1"
        },
        {
            "fixed": "16.4.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ed06c998964cae931ccfe7005a67eeaedaf60e58
Fixed
49af0ac677c5f80e29ec8044c81ac51d3161152a
Database specific 
{
    "versions": [
        {
            "introduced": "16.5.0-rc-1"
        },
        {
            "fixed": "16.8.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32970.json"