CVE-2025-49580
- Source
- https://cve.org/CVERecord?id=CVE-2025-49580
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49580.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-49580
- Aliases
- Published
- 2025-06-13T15:45:58Z
- Modified
- 2026-08-12T14:52:42Z
- Severity
-
- 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki allows privilege escalation through link refactoring
- Details
-
XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-266" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json" }- References
-
- https://jira.xwiki.org/browse/XWIKI-22836
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6
- https://nvd.nist.gov/vuln/detail/CVE-2025-49580
- https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec
Affected packages
Git / github.com/xwiki/xwiki-commons
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-commons
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "7.4.5" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.4" }, { "introduced": "17.0.0" }, { "fixed": "17.1.0" } ], "source": "CPE_RANGE" }
- Type
- GIT
- Repo
- https://github.com/xwiki/xwiki-platform
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "7.4.5" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0" }, { "fixed": "16.10.4" }, { "introduced": "17.0.0" }, { "fixed": "17.1.0" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49580.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "296892834126885246689336097322674796483",
"length": 2693
},
"id": "CVE-2025-49580-06d20559",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateRelativeLinksAcrossWikis"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"176080603180290557542261410259636370758",
"91448260378889329232059815118329461123",
"148198789624309278293121328221306356001",
"86696356611244698194613953235628379421",
"185030167114738536844852937362238142505",
"169472579327801929478661899990183455022",
"319987729733840722074161391084793741907",
"298451332502795053077234733034931599365",
"270949364469061243529634551936223563060",
"72742153606414751669378209928099621200",
"206477920477247793721059400762587792919",
"56420806432106114253796782112587217639",
"164060107665479678998038626365609126551",
"191900461202964757487020765787929782365",
"184979569613896179418613298135841026176",
"273231106673826481387160274115580964226",
"21960593709280208804787295249332605162",
"330394005693938744848257303423339723567",
"30522095002878160774447108008755277001",
"188835721887392240266835599509391455298",
"313278556072637279413973395010327928695",
"287155895871104929236070498641506004730",
"126783517359411255727925434982031657297",
"102718456230584493716033402685655813526",
"168068006351973159228073675352280299250",
"219605022615795774468703377686063210790",
"312579241920501183328017009136519662907",
"127434488242427140287733722455203925699",
"247729825669650903126988447671597189623",
"162905777338698421445199968394104453475",
"237026466521171137730467097796733479516",
"45600657658682459397339558243554178192",
"14325293940602472573684245334205939571",
"106529609420141026594252643277000749170",
"312579241920501183328017009136519662907",
"156039326260923426964927154427214925861",
"159216903599791769797972861174419515050",
"78855553776960622223901435224631275848",
"217262533159183871820593022477273593370",
"235090525660310932421221718383573398124",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"25497585769388321508378479797444130633",
"160343102062433851692596992950656579064",
"7512437442602238234727886043558604775",
"232219079229314030966250604319309090367",
"2302603167334537825025336651184906950",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"169887272022431582726046155802703891572",
"256598295218982891316890258597141624362",
"32673263989631000910840257910388260492",
"109418525925836973337461362998737609157",
"190001021110836726362141153238240339170",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"211765949120895419546213029758633954296",
"323248485402883718787364463759567690001",
"37868331990405411331224604284442182281",
"200977063028844414171494153070360851881",
"257969238311797877916417003926996341374",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"283827500837735914849945791932589848373",
"269876973930956847096836865138138147883",
"145193497543344398896125059199759458191",
"190795393518495651715981419172982692765",
"32133095363641012855228224869662379288",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"47038369548726442004084979181064105563",
"226233472571759720481355670971152818363",
"137753203331942739119229316545166838690",
"279692423342919388436751429537837666032",
"313948152105223557578240611612830595073",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"6139975871424847271231242269752907481",
"25459100779809707042946463892313551935",
"208193603570493596577093723092250576961",
"164671723365475009359398875409766006828",
"281885086679911463927170070444456334453",
"130221501325194525471296094384346891020",
"196248245982092214793206739961966402585",
"23152579549143361888073269812076412689",
"127825708736253156600405406097305022646",
"147876731809715230054033326135363737427",
"147065971474256361588145033959503236422",
"55799733531605044114683661473352612303",
"194631018743326092463080266910650477925",
"202375667294116024208185042124546443849",
"90234813105458395958473243052244891902",
"198701363698160816340971395138502551875",
"249477768953551354709467181656629092064",
"149827139114549480531817888974838147165",
"257065175482790341995573255280305425075",
"164222978500802744206401898510032675812",
"313490020589255728195704585435613578100",
"32176232175054956401626779965185188865",
"127390418900170946519363924332991274283",
"91492639802201264809658305062301062268",
"124440576430565900628801369431066679676",
"241790669383235044736347706432128519468",
"169586037252700498540146799964793188862",
"163878870132862694000972965345414407655",
"272908233960188287537804908566123916273",
"245416791808334579312322127846977239428",
"145980974762331530664261717245286289030",
"219098577489470577076351512050085375898",
"164516439812578057812092657536280248205",
"280381826365949724899881060707503015749",
"330440353750000887841515030754860386053",
"119729021472118921609792274524405810191",
"278803086748130408956902362835272029503",
"320978145929299669999799488310534409010",
"163524277728337027441179969944468086844",
"225106390427853658954743946946298545384",
"310194429194609025922257404268112159386",
"89860179730692010655520879247287344707",
"127684445397770995322965942715538205455",
"224933088080543933445895625640320969853",
"189798401644257148720100871706228776302",
"67202113400062967653247674261307304970",
"259800634408260545718318248858772838249",
"155742261525956267112981017133119044157",
"310826211319374026782668833772737607349",
"310699642529998408429171409964973046169",
"29586160841738678292830329830688133908",
"38102974176055508503793983480880902020",
"224653315953799214999879978931393033486"
],
"threshold": 0.9
},
"id": "CVE-2025-49580-1dceaad7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "230801043884742862008795135754330965230",
"length": 2119
},
"id": "CVE-2025-49580-3ad60def",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateAttachments"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325793366384932067567243203539559214493",
"length": 5417
},
"id": "CVE-2025-49580-44746be0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateRelativeLinks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "77135979315393802777618869102526684899",
"length": 1809
},
"id": "CVE-2025-49580-4728bdc4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "renameAttachment"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "202760741172763210438972053868958289595",
"length": 611
},
"id": "CVE-2025-49580-51ceb802",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "verifyDocumentSave"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273447432492030098157633566654173677480",
"length": 1533
},
"id": "CVE-2025-49580-5cef0a4c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java",
"function": "renameLinks"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3998874320505048898743109019001565072",
"333345106508820733278567391929957257193",
"119172336198050147422198784685791906704",
"86696356611244698194613953235628379421",
"161688590973927195081294226397252063157",
"210575195088937699925084149003577988719",
"329558073255489494418509748944767597453",
"250667260636142156177234392786770121575",
"36361363467520010697051636802012073898",
"265591989651849109631578794145050883611",
"141283674064146071050477884146308015800",
"137604968254324966114344524440233118039",
"5729129465270358424199776016267791244",
"224216737906972158231673154368366631401",
"329598171378584993287062252927609881813",
"451651753292563896459556098457630367",
"196214209452895902858102792359590850069",
"285342335585092880662685003975615623792",
"278954104234554164126871030219705690826",
"31074591746180989966498954724614075032",
"28696154228420594823672142384289681397",
"203041186992174342124532246711915418993",
"325500993518052464518364761043168426698",
"314856109183652018798333823584826208266",
"89175494252297351347028100649553636069",
"112538316374749943835116034472856921448",
"207546965171624519774841061624334653349"
],
"threshold": 0.9
},
"id": "CVE-2025-49580-5ec5dd1b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"301349080362396737969004881125738821597",
"1479984336321597782906495325084418913"
],
"threshold": 0.9
},
"id": "CVE-2025-49580-5ee571d2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-test/xwiki-platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/RenamePageIT.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115342912769273446993572521738548143498",
"length": 2510
},
"id": "CVE-2025-49580-6667a3bd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "renameNonTerminalDocumentLinks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "223088660807537103812553219960681925877",
"length": 2678
},
"id": "CVE-2025-49580-6b9000a2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateFromMacros"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "289474250154335522656283405294684821416",
"length": 2570
},
"id": "CVE-2025-49580-a01df8b3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateAndTranslations"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327603636882249366923129912960676454714",
"length": 2876
},
"id": "CVE-2025-49580-c1bfd9f7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "update"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273171669458005777616022962247525791922",
"length": 1787
},
"id": "CVE-2025-49580-c8a7ae15",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "renameImage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250138363258119421562254685784386553692",
"length": 652
},
"id": "CVE-2025-49580-d29c07de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "beforeEach"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140843675360214481386357036159146708998",
"length": 2006
},
"id": "CVE-2025-49580-d6bfaf3b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "updateFromLinksAndMacros"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "286469387921910530526279596544900216672",
"length": 300
},
"id": "CVE-2025-49580-e19733da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/main/java/org/xwiki/refactoring/internal/DefaultReferenceUpdater.java",
"function": "saveDocumentPreservingContentAuthor"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "126719337316968255889306392803018919975",
"length": 2497
},
"id": "CVE-2025-49580-eac8e536",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/xwiki/xwiki-platform/commit/ab209acd780da69a4c5ff77ff011efd698273cec",
"target": {
"file": "xwiki-platform-core/xwiki-platform-refactoring/xwiki-platform-refactoring-default/src/test/java/org/xwiki/refactoring/internal/DefaultReferenceUpdaterTest.java",
"function": "renameNonTerminalToTerminalDocumentLinks"
}
}
]
vanir_signatures_modified
"2026-08-12T14:52:42Z"