CVE-2025-32970

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32970
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32970.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32970
Aliases
Published
2025-04-30T14:54:52.008Z
Modified
2026-07-10T20:51:28.517637Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Details

XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32970.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
7c923a6f41c24d1c9bc654edffca1051dad4dd21
Fixed
563b140bdb68a542df2661dade6c6fd55c9424b5
Introduced
918ea43fe0d277c28efa21a871175b329c75157c
Fixed
781dce4032a1cec978463de2b9bc4ea087c922bc
Introduced
526fcc68b3f75862a2af7395b5a6dfdd3d2166a5
Fixed
b7e6ace16af1a52758fb881837d1d05f6f51a418
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "13.5"
        },
        {
            "fixed": "15.10.13"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.4"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.8.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
311979b15a606d822a35bdaf6587cc9eda3274e7
Fixed
97e8f148873bd95834ed6f93e564bbf77070ea2b
Introduced
3c6f5cf138d8095f63631e554ba448e4b780e162
Fixed
c20d0fd69f97fd2d2eaa6c78d785f2097ed5a5d0
Introduced
177e524c2e218fe5de776619271b7cd12c929488
Fixed
49af0ac677c5f80e29ec8044c81ac51d3161152a
Fixed
6dab7909f45deb00efd36a0cd47788e95ad64802
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "13.5"
        },
        {
            "fixed": "15.10.13"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.4"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.8.0"
        }
    ]
}

Database specific

vanir_signatures_modified 
"2026-07-10T20:51:28Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32970.json"
vanir_signatures 
[
    {
        "id": "CVE-2025-32970-0a125559",
        "digest": {
            "line_hashes": [
                "328014946009757899182761379479032064771",
                "295741419983007358089386529199637231277"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/test/java/org/xwiki/url/internal/DefaultURLSecurityManagerTest.java"
        }
    },
    {
        "id": "CVE-2025-32970-1756018b",
        "digest": {
            "function_hash": "286435668565893114614487118000649774558",
            "length": 1032.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "function": "handleConversionErrors",
            "file": "xwiki-platform-core/xwiki-platform-wysiwyg/xwiki-platform-wysiwyg-api/src/main/java/org/xwiki/wysiwyg/internal/converter/DefaultRequestParameterConverter.java"
        }
    },
    {
        "id": "CVE-2025-32970-1be729aa",
        "digest": {
            "line_hashes": [
                "109342328144910935382964538373505819207",
                "285838231002547783616210210916712779089"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-api/src/main/java/org/xwiki/url/URLSecurityManager.java"
        }
    },
    {
        "id": "CVE-2025-32970-2f9667bf",
        "digest": {
            "line_hashes": [
                "124170674800213407410227572823915157686",
                "68964808724376973997607520375666861120",
                "207727678737076763366760266938909113149",
                "129436350225964044683870369761504613744",
                "108127274416358755177863266180486648264",
                "211657563554373412864480158373743500435",
                "317584082191001736358487479911659741093",
                "193416917462738539602700522551513406482",
                "308373081737525897051304052069842272968",
                "188199451492638638668424790325158090429",
                "150579984874630230861245006498027772144",
                "124862079463229638602488488572964591917",
                "210581856410098645232414252536706240751"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-wysiwyg/xwiki-platform-wysiwyg-api/src/main/java/org/xwiki/wysiwyg/internal/converter/DefaultRequestParameterConverter.java"
        }
    },
    {
        "id": "CVE-2025-32970-37dd3002",
        "digest": {
            "function_hash": "265989637935387991363806307404897020530",
            "length": 877.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "function": "isDomainTrusted",
            "file": "xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java"
        }
    },
    {
        "id": "CVE-2025-32970-8022ebe1",
        "digest": {
            "line_hashes": [
                "74181346392458410937364900915909293529",
                "182118931338783325677807847927469169381",
                "146929244322283340431306127876002738734",
                "255072776614805832447773445102303515378",
                "295393290557511587368872334865252220878",
                "255792596058924130361998965979171136812",
                "105922757454511415347782881972622565287",
                "167589162155265484174439350659195805118",
                "174159237637411779026461965153410165521",
                "253092321964527622659233625303613841254",
                "290735000909086495498867604955686001622",
                "294263229034403362785901361851844766119",
                "195561947431587315878213347917123654756"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802",
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-url/xwiki-platform-url-default/src/main/java/org/xwiki/url/internal/DefaultURLSecurityManager.java"
        }
    }
]