CVE-2025-49580

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49580
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49580.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49580
Aliases
Published
2025-06-13T15:45:58.451Z
Modified
2026-07-15T02:15:27.454404982Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki allows privilege escalation through link refactoring
Details

XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. This vulnerability is fixed in 17.1.0-rc-1, 16.10.4, and 16.4.7.

Database specific 
{
    "cwe_ids": [
        "CWE-266"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49580.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
09d8d9877b04a5183281ed3f52d9997eea5a1d69
Fixed
c3bb3381253c71df533fe0c31a02d3ce1e04bae7
Introduced
526fcc68b3f75862a2af7395b5a6dfdd3d2166a5
Fixed
413a45b9a7643cc3d1451364d5374f4f11229e38
Introduced
e84d9bd1b4c0c8219597e10acfd8fbd692416294
Fixed
7f1dd9fba90aca38f2ab8d5325bf93c24543a730
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.5"
        },
        {
            "fixed": "16.4.7"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.10.4"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.1.0"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
565f76b670142f39de4e38f7dcc71deee9d2376f
Fixed
f5a9a0762750936523187286919ec4c1892d6fea
Introduced
177e524c2e218fe5de776619271b7cd12c929488
Fixed
02a3be6e06c5af8f157434daf760396c36726500
Introduced
7edb5b7d98170ec081c7e30237971d7dfb8a4401
Fixed
30daaf6500353c1615bf54ffc6fa95e769c2b82a
Fixed
ab209acd780da69a4c5ff77ff011efd698273cec
Database specific 
{
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.5"
        },
        {
            "fixed": "16.4.7"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.10.4"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.1.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49580.json"